Currently, to change the business unit of a user, it is important to note that the calling user must have system admin or equivalent privileges to perform this activity. If you do not wish to provide the system admin role, you can consider adding the required privileges to the expected tables. This approach may help in achieving the desired outcome without granting full admin rights.

But we need to have a user with minimum permissions to have access to assign security roles to the users.