Who can change a user's role?

Only a tenant-admin or global-admin can change roles. Go to Users in the sidebar, open the user's detail page, and update the Role field.