title: Support for Azure Managed Service Identity against Group resources
body: <p>I've been testing the new managed service identity (<a href="https://docs.microsoft.com/en-us/azure/app-service/app-service-managed-service-identity" rel="nofollow noreferrer">https://docs.microsoft.com/en-us/azure/app-service/app-service-managed-service-identity</a>) and I can get a bearer token for the service identity just fine.</p>
  
  <p>I have tried to add the service principal as an owner of an O365 Group, and tried to use the service principal to update the Group photo, but I get access denied. I did manage to list a group just fine.</p>
  
  <p>I figured since app-only tokens won't work for updating a Group image, then a service principal might work as a work around.</p>
  
  <p>My question is, would this be a supported scenario in the future as I don't want to use a regular account as a service account to work around this limitation.</p>