We have a user who is in a custom group. That group has access to the Users section. If they create a new user, they can only assign users to the same group that they are in, not any other groups. How is this configured?