Portal admin user role

We have tenant admins, who can create users at a tenant level, but the super users have much higher permissions than just user creation. We need a portal-wide user creation 'portal user admin' type role, so service desks don't need a tenant admin account for each tenant, and can create and amend users in all tenants, but without needing the portal super user account which has access to all levels of config across the portal environment.