In an Azure environment, to assign the Storage File Data SMB Share Elevated Contributor role to a security group for a specific file share, what is the initial step required when the environment is hybrid and uses Azure AD?