Your network contains an Active Directory forest.
The forest contains a System Center 2012 R2 Configuration Manager Service Pack (SP1) environment. The environment contains one primary site.
You need to ensure that the members of a group named Group1 are allowed to deploy applications to desktop computers.
The solution must minimize the number of permissions assigned to Group1.
What should you do?