https://www.khamis.net/2017/06/01/role-in-azure-active-directory-to-grant-access-to-create-and-remove-azure-ad-users-and-groups/