This should be a simple fix but I seem to be missing it.
I created an AD Security Group (AppAdmins) with these ConfigMgr roles: Compliance Settings Manager, Application Administrator, Operating System Deployment Manager.
AppAdmins members are able to load the console and create applications. However, they are not able to create requirements on Deployment Types using the "Device" category (eg Operating System).
What permission is the group missing?