Comment by thesimon

Why? We only know that they are not able to create new users.

But at least changing passwords of existing accounts seemed possible according to the screenshots, perhaps disabling 2FA as well.

As long as Okta does not provide a list of what the user was able to do, we don't know