Hey man, no idea if you ever figured this out, but if not, remove "origin": "Application", from all custom roles.  That is what AzureAD doesn't like ... View more