Since the migration app bypass the authentication layer the commands don't contain the group claim extracted from the token when BYOG functionality is enabled. In particular this check is failing.

Solution proposal:

Remove the check that verifies the group claim in the command, as already did for USER and CLIENT

Please add IT to verify the correct behaviour