docs(sso): say what a directory role name needs from Microsoft Graph

[marevol]

Problem

entraid.permission.fields is described as naming group/role fields, and the guidance
under it tells the reader to add displayName because security groups carry no mail.

Applied to a directory role, that does nothing.

With the permissions this page asks for — User.Read plus GroupMember.Read.All, or the
Group.Read.All / Directory.Read.All substitutes named in the note above it — Microsoft Graph
answers /me/memberOf with displayName null for a #microsoft.graph.directoryRole entry:

member={roleTemplateId=…, @odata.type=#microsoft.graph.directoryRole,
        displayName=null, description=null, id=…}

So a directory role only ever contributes its GUID as a permission — and it does so silently,
because a permission field that is absent is not an error. An administrator who grants access by
role name sees the documented setting have no effect and no message anywhere.

What fixes it

Granting RoleManagement.Read.Directory, or Directory.Read.All, makes Graph return the name:

member={roleTemplateId=…, @odata.type=#microsoft.graph.directoryRole,
        displayName=Global Administrator, …}

and the role's displayName becomes a permission value, so a document scoped to
{role}Global Administrator becomes visible to members of that role.

Verification

Checked against a live tenant on 15.8, with a document scoped to the role's name and another to
the role's GUID:

Delegated permissions	role permissions resolved	name-scoped document
User.Read + Group.Read.All	GUID only	not visible
User.Read + Group.Read.All + RoleManagement.Read.Directory	GUID + Global Administrator	visible
User.Read + Directory.Read.All	GUID + Global Administrator	visible

Change

One note, where the permissions are listed, in all seven languages. No behaviour claim outside
what the table above measured.