Depends on the roles assigned. Generally speaking, you'd need a GA. as noted in the documentation:
A global administrator assigned the Directory.AccessAsUser.All delegated permission can update the accountEnabled status of all administrators in the tenant.