Use ids of source cloud identity entities for restriction