Even under a search base, I don't think CN is unique. We should always have the group DN if we're syncing to teams with maps_to set.