I have created a custom role for teachers that will allow them to create and edit users, courses, and enrollments. I did this by giving them the ability to "Read" the domain only. This works, for the most part. The teachers assined to this new custom role can toggle back and fortth between the teacher/admin app, and can perform all of the above functions except editing the enrollment status. Without giving the teacher full admin permissions, what domain settings to I need to check to be able to accomplish this goal for this custom role?