Locking down AD Group so only specific group members can add users to the group without requiring approval.

Hi mskhan2 

You'd control this via your workflows start conditions

In the example below, I have a group called "Add to group without approval", and my filter condition is that the workflow should only fire IF the initiator (person making the change) is not a member of that group.

Please note however, if the user is an ARS Admin, they usually don't require approval. If you need ARS Admin to conform to this rule also, you need to click the "Enforce approval" check box under the "Run as" options at the bottom of the form