Some AD group can contain #, we should support it
LINKS-122 Can not limit an application to a group that has a # in the id