How can we restrict users or group to manage user management without System Administrator Access

Question

Is there a way we restrict users or group to manage user management without System Administrator Access.

Assume we create a help desk group and they do the following

1. Add or Manage User
2. Add or Manage Group

Answer 1

It is currently not possible to separate this from the System Administrator role. We introduced "System Privileges" in our 8.2 cloud release, and SDL Web 8.5 (due later this year) will include this.

Check the following links for more information:

• List of privileges
• SDL Web Privileges

Answer 2

AFAIK, it is not possible to manage user management without system administrator access OOTB.

The main thing to note, in Tridion UI, user management is part of administration tab which is available to you only if you are administrator.

There is a work around that can be implemented:

1. Create a custom application and implement functionality required like add user / group, remove user / group to the Custom application. Custom application will use one administrator account to perform those updates.
2. Give link to this custom application in custom pages / add gui extension to add button in ribbon toolbar.
3. To stregthen the security, in the load of custom application check the group of the user logged in and if it is part of helpdesk group then only allow them to make updates using that UI.

We have done similar implementation by using custom pages to manage override checkout of other users and override publish transactions.