Get-AzureAdGroup doesn't support filter security groups, this is required for RBAC. Role assignment principal must be a security group. <!---@tfsbridge:{"tfsId":3639263}-->