...
Administrator can create a User account
Administrator can assign a role to a User
Administrator or Manager can activate / inactivate a User
Administrator can create a Group
Administrator can activate / inactivate a Group
Administrator or Manager can set default domain for Group
Administrator or Manager can add a User to a Group
Administrator or Manger Manager can set default import configuration for a Group
Administrator can act as any User (and then follow any User workflows)
...