I am have a set of users that needs to see logs so they work with users in troubleshooting access. I cannot give them full group membership rights because of security policy. I also cannot give full read only admin rights as that seems to give admins the ability to see client secrets for applications. I'd like to create a custom role for them, but I cannot figure out if and how it is possible. Giving them the ability to view users and view groups does not seem to give them the log viewing rights needed.