@Jacob D Unless they are on the new domain system, you gotta use the roles rest service