So we have a telecom guy who does all the phone/blackberry ordering etc. and also helps get the phones activated. I've given him the ability to set up enterprise activation however the only piece he is missing is the ability to add send as permissions to the blackberry service account under security in AD.

I've tried delegating control in AD for him but can't seem to give him rights to just give send as permissions. The only way that seems to work is if I give him rights to delete and create user accounts as well and I don't want to give him those priveleges.

Has anyone else ran into this problem and if so did you find a way to delegate those rights without giving too many?