Importing users under subdomains is now also possible. This feature is meant to aid our ever-growing customers, with complex Active Directory systems. This can be done just as easily as before, but do check our documentation to be sure.
However, please keep in mind that old AD users that were provisioned using the Create User window that did not ever log in to Orchestrator will stop working. To fix this, the user should be deleted and added again.
Migrating to 2017.1 SP1 encountered some issues if credential assets contained the single quote character (`) in the username.