Correct role for Admins to change their own password?

[cnegrete]

We have a "small" issue on a deployment (a migration from ACS, so we're using only Device Admin license):

The admin users (which weren't migrated from ACS) that we created ("promoting" the users as the documentation says) only should have permission to admin standard users, network devices and logs, and they do, but they are unable to change their own admin password.

The following three Admin groups are enabled for the users:

• Identity Admin
• Network Device Admin
• MnT Admin

Om the documentation, I can't find another group (other than SuperAdmin) that could let the users change their own password. Is this something they should be able to do? Or is this an expected behaviour?

Thanks for your time.

[Ben Walters]

What version of ISE are you running? 

In our 2.4 deployment all users, even read-only have the option to change their password, after they log in to ISE they can click the gear icon in the top right corner of the screen and select "Account settings". 

I am guessing this feature is available on all versions above 2.0 with the updated GUI.