Grant designated Help Desk Technicians permission to assign membership to only three specific AD groups.
Is there a way to grant access to Help Desk Technicians assigned to specific delegated roles (e.g., Help Desk and HelpDesk‑Plus + Password Reset) so they can grant access to only three specific AD groups to users with the ability to still be able to view all of the AD groups currently assigned to a user? Our goal is for them to retain visibility of all group memberships listed under Member Of, while only being able to grant membership to three specific AD groups. We did perform testing by editing a Help Desk Technician under Visible Groups and adding the three specific AD groups under Included Groups, but doing so removed their ability to see all existing group memberships for users under Member Of. We're trying to determine if this is a supported functionality.