Sailpoint has introduced few time ago a new feature PTA : New Capability: Privileged Task Automation! - Announcements / Product News - SailPoint Developer Community
Privileged Task Automation - SailPoint Identity Services
Which can be use to build and let enduser perform some administrative operations like create active directory groups, …
This can combine workflows + interactive forms and require to enable Privileged Access Gateway on your virtual appliance as mentionned in the documentation.
To see how its look like, you can try to create new worflow from the UI :
With select a Template option and select the template “Create a Security Group in Active Directory”
This will automatically create and display a sample AD group creation workflow, including interactive forms and a launcher.
This should give you an idea of how it works, allowing you to adapt it to your specific use case.