I recently switched my sssd to 1.9 so I can try the native Active Directory support.  Previously I was using:

id_provider = ldap
auth_provider = krb5
chpass_provider = krb5
access_provider = ldap

And now with 1.9 I'm using:

id_provider = ad
auth_provider = ad
chpass_provider = ad
access_provider = ad

This works great except for one thing.  ldap_access_filter no longer does anything so everyone can log into all the machines.  When I'm using access_provider = ad how do I restrict which users and groups have access to the machine?