Do I have to deploy cloud connectors in every forest i want to deliver VDA's from? Or can I run them in a "service-forest", with two-way trust? Domain selector currently only gives me the option of selecting my service-forest.

Needs CCs in the forests the VDAs live in, can use CC appliances for user forests for lookups