Hi All, When I delegate AD permissions so that user can read all user properties, why can't they see "memberof" property of users? Should I be delegating something else to them in AD? Ideally, I don't want them to add/remove group membership. Thanks.

Hi, I would like to know what tasks you have delegated to that user? Read all user information Modify the membership of a group Or maybe you select only user object: Read all properties Please try to add read and write group membership permission. Regards, Yan LiYan Li TechNet Community Support

Hi Deligate: Read All User Information & Read all inetOrgPerson information Good Luck

Hi, I would like suggest you create a custom task to delegate, and select only user object: Read all properties Read and write group membership Regards, Yan LiYan Li TechNet Community Support

Hi, I would like suggest you create a custom task to delegate, and select only user object: Read all properties Read and write group membership Regards, Yan LiYan Li TechNet Community Support