IT Security Manager - Creating a user administrator role

Summary:

I am looking for guidance on creating a custom role based on IT Security Manager that only allows a user to create users and assign / revoke roles.

Content (please ensure you mask any confidential information):

Our customer has a group that will be responsible for user provisioning and role assignment. We do NOT want to allow these users to have access to any of the other features in Security Console (I.E. creating / modifying custom roles, configuring SSO, being able to access / modify keys).

I have attempted to create a copy of IT Security Manager and tried to roll back privileges, but what I have found is that there is a sub role called Security Management. If I remove this role from my custom role, I lose access to security console in navigation…however, when I add it back it provides access to all security console functions.