--subject does not work with AD groups that are not in Azure Devops

I am currently trying to add a newly created group to a repository in Azure Devops. The only way I have found to add a new group is to go in and manually add the group somewhere else. Only then is a subject Descriptor generated for the group for me to add it to the repository. This takes away all automatable functionality of groups in azure devops from us.

This is a large limitation and something I believe others will have issues with too.

Thanks

---
#### Document Details

⚠ *Do not edit this section. It is required for docs.microsoft.com ➟ GitHub issue linking.*

* ID: 1121ea02-7c35-1af4-0226-e277c8d1d566
* Version Independent ID: 5697a5d6-2a89-282c-1b83-22bf82068a6c
* Content: [az devops security permission](https://docs.microsoft.com/en-us/cli/azure/devops/security/permission?view=azure-cli-latest#az_devops_security_permission_update)
* Content Source: [latest/docs-ref-autogen/devops/security/permission.yml](https://github.com/MicrosoftDocs/azure-docs-cli/blob/master/latest/docs-ref-autogen/devops/security/permission.yml)
* GitHub Login: @rloutlaw
* Microsoft Alias: **routlaw**