to which groups can you apply microsoft endpoint manager policies for microsoft office apps