Azure - Automate removal of role assignments with Unknown Identity (user, group, SP, etc.). In past Classic "Co-admin" you had to remove link, but then RBAC would trigger removal of role association on Identity removal. Why do we have to build custom automation to perform something that should be foundation, I feel like we're going backwards - https://docs.microsoft.com/en-us/azure/role-based-access-control/troubleshooting