Yes—if the user has the correct role, they can create, delete, and manage group memberships. This typically is done through a delegated web form where the end user has to have a specific role to use that form. In addition, role modeling and business rules can be used to assign both security groups and distribution groups.