As it stands right now a Group Admin (even with User editing turned on in access level) cannot edit a User's email address or federation ID. They can change everything else with that user but not those two things.
So if there is a change in email or federation ID the group admin has to contact a System Admin to make this change which can cause serious delays.