CAMID("::Tenant Administrators") CAMID("::System Administrators") read grant setPolicy grant traverse grant write grant execute grant true