...
In our internal directory scenario described above, the admin when onboarding these applications in EmpowerID would select the Account Store that had been defined for the app's internal directory. This lets EmpowerID know in which Account Store the accounts and groups are located that can be granted access to the application. However, in our eternal directory scenario, the admin would onboard multiple applications where the Account Store of the external directory they relied on would be selected. In this scenario, where many applications in EmpowerID share the same Account Store for their security, the application owner can select which specific groups in that Account Store should be identified as granting access to that application.
...
Key Components Related to an EmpowerID Application:
...