Why being only a User Administrator get this login error: sign-on policy denies access

Summary:

Does the user needs to belong to both 1) Identity Domain Adminstrator & 2) User Administrator group to be able to add or delete users?

If we remove the user from the Identity Domain Administrator group, he runs into this exception at the time of login.

Content (please ensure you mask any confidential information):

same as above

Version (include the version you are using, if applicable):

OTM 26C

Code Snippet (add any code snippets that support your topic, if applicable):