If group entity is not set, all group attributes are
exposed to user which may lead to exposing sensitive attributes.