Entitlement required: manageUserGroups (Manage users and groups) or manageAllUserGroups (Synchronize users and groups) or manageUserStandardGroups (Manage users and standard groups).
Note: You only need one entitlement, but you can have more than one.