Admin managed

In an admin managed workspace, users need the 'manage roster' permission to update users.