Cloud Web security - AD nested groups

Anybody know for sure whether AD nested groups are supported with DirSync client using Cloud web Security?

I am a member of Group A.

Group A is a member of Group B.

Both groups A and B sync to cloud.

Policy is assigned to Group B.

I appear not to be getting policy.  If I click on Account \ End Users, run a search including Group name\membership, I only appear to be a member of Group A and not Group B.

AD is 2008 R2 native.

How do you guys deal with nested groups?