So far we have been adding people to site-admin group in order to enable them add users. However, these folks were only a trusted few individuals who knew what they are NOT supposed to do.
I need to transition this work to Service Desk which would have huge number of people. How do I restrict their access to be only able to create new users, reset passwords, reactivate/deactivate users etc. Basically, everything that we do as part of User Management.