Shared services security- Is this even possible?

Question

I want to know if the following is possible using shared services security:
I want to set up an MSAD group that will have say 50 sub groups.
I will define this super group as an external directory in SS.
I will then assign security (both roles and filters) to each of the 50 sub groups.
There will be no groups or users in the native directory.
Based on user needs, the MSAD team will move users from one subgroup to another without logging into Shared Services.
My expectation is when they move the users from one subgroup to another, the user will have the security of the group they were moved to.
Is it possible to set up security this way in shared services? I have been experimenting and having a miserable time getting it to work. So just wanted to know if I am doing something wrong or just wasting my time.

Answer 1

I think this will work, but note that you are not really using SS inherited security.
What you might do is something like this:
MasterGroup <--Assign provisioning here
|_Subgroup1 <--Assign filter
|_Subgroup2 <--Assign yet another filter
|_Etc.
With the above layout you define provisioning roles once at the topmost group (MasterGroup) and then assign unique security at the subgroups.  The users are in the subgroups and their usernames will go to their ids (which will have no provisioning), then their immediate group (ditto), and then the parent group (which will). 
What you have defined for security (as opposed to provisioning) sounds good to me although I have never tried to do this with MSAD groups.  I don't see a reason for it not to work.
Regards,
Cameron Lackpour