Is it possible to create a CAAD Protection template to prevent adding members to a security group but allow deleting members?
Change Auditor Protection template has an operation called Modify. If this Modify operation is enabled then it restricts adding and deleting a member of a Security Group. If this Modify operation is disabled then it allows adding and deleting a member of a Security Group.
Hence, it is not possible to create a CAAD Protection template to prevent adding members to a security group but allow deleting members.