`Get` on non-existent Management Group ID returns 403 instead of 404

When checking for the pre-existence of a Management Group prior to creation, a `Get` on the new group name with an appropriate (Owner) account results in a 403, rather than a 404.

The client is fully authorized, and can create, read, and delete existing Management Groups without issue.

Example:
```
managementgroups.Client#Get: Failure responding to request: StatusCode=403 -- Original Error: autorest/azure: Service returned an error. Status=403 Code="AuthorizationFailed" Message="The client ‘00000000-0000-0000-0000-000000000000' with object id ‘00000000-0000-0000-0000-000000000000' does not have authorization to perform action 'Microsoft.Management/managementGroups/read' over scope '/providers/Microsoft.Management/managementGroups/acctestmg-200521085208122167' or the scope is invalid. If access was recently granted, please refresh your credentials."
```

Start with the managementgroups.Client#Get call and the Azure Management Groups API behavior shown in the example. Confirm the expected response for a non-existent group with an authorized Owner account, then identify the relevant API specification or test; done means the agreed 404 behavior is represented there.

Written by the indexing model from the issue text.