Enabling Movement Activity for S_USER_GRP 
By default, SAP NetWeaver Application Server ABAP checks the S_USER_GRP authorization object for activity 01 Create when you try to move a user from one user group for authorization checks to another. To create a distinction between the activity of creating a new user in a user group for authorization checks from moving a user to a new user group for authorization checks, enable activity 50 Move for S_USER_GRP.
This customizing is client-specific.
Set the CHECK_MOVE_4_CNG_GRP parameter to YES in the USR_CUST table with Maintain Table Views (transaction SM30).
Adjust the authorization roles of the appropriate user administrators.
SAP Note 1663177 SU01: User group as required entry field