https://rickrainey.com/2015/02/13/using-group-claims-in-azure-active-directory/