fix ad group role retrieval