Giving a Support User only some Domain Admin rights

I need some of my support team to be able to do certain domain admin functions, like create Distribution groups, create users, and add an email alias. But I don’t want them to have the full domain admin rights, like access to server etc. I know there is a way to do this, but it has been awhile since I have needed it. So how can I best accomplish this?