A standard Active Directory service (or synchronization service) should allow filtering of identities synchronized with K2 label by the LDAP organizational unit parameter (something like this LDAP://OU=department,DC=company,DC=com). Because this i...