For the life of me I cannot figure out what permissions combinations sendCommand needs to be able to send a Run Command targetting Resource Groups.