The identifier used for the user administrator role is USERS_ADMIN.
The USERS_ADMIN role authorizes users to:
- Manage users, groups and roles.
- Create users in the internal realm if an internal realm is available.
- Assign any feature role to another user.
User administrators can only give an administration role they already have.