https://peterdaalmans.nl/2018/10/03/rbac-in-azure-ad-intune-and-scope-tags-explained/