Is there some reason Atlassian has decided that an Organization Admin - the highest level permission - is the right permission set to manage portal-only users instead of the user access admin role?
This seems really backwards that I have to give our helpdesk manager access to the org admin role so that they can manage portal-only users.