A company uses Microsoft Entra ID (Azure AD) and wants to reduce the burden on IT helpdesk staff, who currently process all requests for users to join collaboration groups. Business requirements are: end users must be able to request to join specific security groups themselves, each group's designated business owner must approve or deny requests before membership is granted, and no changes to on-premises Active Directory are permitted. Which solution should you recommend?