Agents cant modify profile

Not sure what I changed in Roles but my agents cant edit their own profiles. Specifically they are enabling 2FA and get Current user is not able to change two factor authentication settings. What role permission is overseeing this?