Sure...

the application they are writing has roles within the application itself...A decision made way above me.

These roles can be associated to users of the application

These roles can be associated to Groups of the application

These roles can be associated to Active Directory groups from MS.

We need to know who is in the active directory group. When a user logs in we first look for the user in users table. Then we look at the AD groups and go to MS to authenticate. We need to store the AD group name or guid so we can look it up later.

So when they use the 3rd option how do I store the active directory name?