Users with the User Administrator role can create users and manage all aspects of users with some restrictions (see below). Only on users who are non-admins or in any of the following limited admin roles: * Directory Readers * Guest Inviter * Helpdesk Administrator * Message Center Reader * Reports Reader * User Administrator Reference: https://docs.microsoft.com/en-us/azure/active-directory/users-groups-roles/directory-assign-admin- roles#available-roles