az ad group member list and GET /groups/{id}/members return an empty collection, without error, for groups whose members are service principals. Records the reads that do work and the rule to trust a Terraform plan over that output.
