Here is a great summary of articles for using MFCMapi from MAPI Internals blog. Under Third Party application Support, my blog was listed under Using MFCMapi for email reconciliation issues.
From testing, the Edit a Group permission does not permit a junior help desk admin to make changes at a group level. It allows them to view groups in order to add a user to an appropriate user group. The permission is misleading.
I am back from holiday so I am back to blogging!!! Another issue with application pushes is BAS attempts to reconcile device information prior to the handheld agent submitting this data to the BES. You can check for this issue by viewing the Resolved applications for the user and it shows the affected application under [...]
Heard back from the escalation team. According to RIM, this issue is by design. There was a bug in 5.0.2 which should not have allowed the help desk role to be able to view groups without the edit a group permission.