Intune permissions for group assignment

i am setting up our Intune environment in a co-managed configuration.  my plan is to move the application deployment workload to intune and have our desktop techs use intune to deploy apps to end user devices.  i've setup a custom role in intune and verified that the desktop techs can access the needed functionality in the device records, however, i need them to be able to add/remove users and devices to intune groups for application deployments.  what permissions need to be set for this function and where would i find it?