How can global Administrator create a tenant-specific group?
Is it intended that only tenant administrators can create tenant-specific groups? Wouldn't it also make sense for global Administrators to also be able to create tenant-specific groups. Furthermore, it would also seem useful for the Global Groups panel to include the Tenant ID field just like the global Users panel. Thoughts?
Yes, it's the current behavior.
I've created an improvement task https://jira.nuxeo.com/browse/NXP-11832, you can follow it to see when it's done.