It would be helpful to be able to assign roles to groups, so that members of those groups got those permissions. Members of multiple groups would get all of the permissions of those roles. This would allow tenants with SCIM set up to manage roles on the IdP side.