Which roles or privileges give access to the "Configuration" tab?

Summary:

We have notice that a lot of our local HR have access to the Configuration tab and can then create Sandboxes…

We would like to remove this privileges to keep it only to the Application administrators but we cannot identify wich roles give acces to this tab.

Thanks,

Regards,

Lucie

Content (please ensure you mask any confidential information):

Version (include the version you are using, if applicable):

25A

Code Snippet (add any code snippets that support your topic, if applicable):