To further improve the end user experience, Azure AD offers the ability for users to create and manage their own security groups and Office 365 groups. In addition, users can also request security group memberships as well as Office 365 group memberships. In such cases, the owner of these groups can approve or deny their membership requests. By delegating group membership control, organizations can ensure that the people who best understand the business context for such memberships are the ones controlling group membership. It's important to note, however, that this feature applies only to security groups and Office 365 groups. It does not apply to mail-enabled security groups nor does it apply to distribution lists. There are essentially two flavors of self-service group management currently available. These include delegated group management and self-service group management. An example of delegated group management would be a scenario where an organization uses a SaaS application, whose access is managed by an administrator. As the company grows, access management becomes a bit cumbersome for the administrator to handle. To ease the burden of granting access and revoking access to the application, the administrator requests that the application owner create a new group. 

After the group has been created, the administrator assigns access to the application for the new group. He also adds all users who need access to the application to this group. Because the application owner created the group, he has he ability to add and remove users from it. Users added to the group are automatically granted access to the application, while users that are removed from the group have their access to the application revoked when the leave the group. By delegating group membership management to the application owner, the application owner no longer needs to wait on the administrator to provide and revoke access to the application. Of course, however, the administrator would still be able to see who has access to the application, and he could block access as necessary. A self-service group management example would be a scenario where an app owner manages an application. In order to grant a group of business users access to the application, the app owner creates a group in Azure AD, grants the group access to the application, and then enables self-service group management on the group. When a user in the organization needs access to the application, the user simply requests access to it from the Access Panel. When the request is approved, the user receives access to the application.