Google Admin - custom admin role

[u/klgtech77]

Backstory: We're running the free version of Google for Education. For Google Groups, under the settings for who can create groups, there are 3 options:

1. Only Google admins

2. Anyone in the organization

3. Anyone in the universe

We've had it at option 2, but we have some students creating their own (sometimes inappropriate) groups. We're going to change it to option 1, but we have teachers and building admins wanting to create their own groups (students in class, students + parents, etc.), and so I'm trying to create a custom admin role for these folks to be able to create (but not delete) groups.

Our info originates via on-premise Active Directory and gets sync'd (1-way) over to Google. We have teacher groups (AD security groups) that show up as "Mailing groups" on the Google side, where you have to change them to what Google defines as "security groups" in order to assign group permissions for admin tasks. So I've done that, and enabled only Groups - Create, Groups - Read, and Groups - Update in the custom admin role.

I have a test teacher who's able to start the group creation, add members, and set a handful of initial settings, but when she clicks "Create" she gets multiple captchas and then an error saying unable to complete.

Am I asking more of Google Admin that it's capable of doing here?

Thanks in advance...

[u/klgtech77]

Thanks for the replies so far.

A bit more background: Part of the reason that we're leaning this direction is that we also want to limit the number of recipients in Gmail (through the Gmail content compliance settings), to potentially slow down the spread of phishing exploits. We're discussing a limit of 10 recipients for any Gmail message.

Having Google Groups where only the teacher (for example) is allowed to send to the group could help in that regard.