Roles can be configured locally on the switch using a Local User Role (LUR) or on a ClearPass server, using a downloadable user role (DUR). Roles that are configured locally can be assigned via any RADIUS server, using the Aruba-User-Role VSA. When using DUR, the ClearPass HPE- CPPM-Role VSA is used in combination with HTTPS to transfer the role to the switch.

When adding a switch with an existing configuration into a group in Aruba Central, the group requires devices to have factory default configurations to allow Central to apply the group config correctly.
If the switch has an existing configuration, synchronization and auto-commit may fail because of configuration conflicts.
Option A: Pending authorization is unrelated to config synchronization.
Option C: Auto-commit can be disabled but does not block syncing existing config.
Option D: VSX support limitations are irrelevant here.
Therefore, the likely cause is that only switches with factory default config can be added to a group with existing config.
References:
Aruba Central Device Group Management Documentation
Aruba Central Configuration Synchronization Best Practices
HPE Aruba Central User Guide

The LACP fallback command in Aruba VSX configurations allows the system to continue forwarding traffic even if LACP negotiation fails or is not established. This is useful when provisioning a gateway or link that does not support LACP, ensuring that the port remains operational in a static manner.
It is not specifically for backward compatibility with LACP v1.
It does not relate to operation with a single partner interface.
It also is not about active/passive LACP modes per se.
Therefore, LACP fallback is configured to support provisioning a gateway without LACP.
References:
ArubaOS-CX LACP Configuration Guide
Aruba VSX LAG and Fallback Documentation
HPE Aruba Networking Best Practices for Link Aggregation