Assign application group roles for on-call teams before SLAs lapse

Your group provisioning requests arrive unlinked to service principals, causing delayed access and missed on-call coverage. This ensures correct role assignments for service accounts before outreach SLAs lapse.