I admit that I am not an AD expert, and I got this question following an implementation. Version is R80.20.
So basically, the user wants to be able to to use OU as objects in the policy. The closest I could get to their request is to match machines based on a search on the OU, which return an AD group. However the user would really like to use directly OU but I'm not certain about the implementation that's requested, since in my opinion if you create an acces role and search for machines based on OU, this boils down to the same thing.
TL;DR: is it possible to create just OU objects in a policy to identify machines?