The issue was legacy permissions from 2017.2 and prior.
I added browsing of Builtin-Domain, Organizational Units, and Containers.
We had the helpdesk interface tightly locked down previously.
I haven't heard of any other legacy issues. Hopefully, this will be the only snag.