Add exception access to a user identity group

Your conditional access exception requests often require manual group changes and separate audit entries, which delays remediation and frustrates engineers. They are applied and logged same day.