You may have noticed that you are unable to add users to groups, via the WI, when using the Built-In Access Template: “Groups - Add/Remove Members”, the following access denied error gets displayed:
This is a product defect (TF00765208).
1) Create an access template which allows reading objectClass attribute for the corresponding member objectTypes. See screenshot:
2) Assign it to the same level where the 'Groups - Add/Remove Members' access template has already been applied.
This will be fixed on a future release of the product. Please refer to this article for updates or contact support referencing the defect ID TF00765208.