diff --git a/core/res/AndroidManifest.xml b/core/res/AndroidManifest.xml
index 258a050b21afd..34543f13c1667 100644
--- a/core/res/AndroidManifest.xml
+++ b/core/res/AndroidManifest.xml
@@ -2459,8 +2459,9 @@
         android:protectionLevel="signature|privileged" />
 
     <!-- @SystemApi @hide Allows an application to create, remove users and get the list of
-         users on the device. Applications holding this permission can only create restricted,
-         guest, managed, demo, and ephemeral users. For creating other kind of users,
+         users on the device. Applications holding this permission can create users (including
+         normal, restricted, guest, managed, and demo users) and can optionally endow them with the
+         ephemeral property. For creating users with other kinds of properties,
          {@link android.Manifest.permission#MANAGE_USERS} is needed.
          This permission is not available to third party applications. -->
     <permission android:name="android.permission.CREATE_USERS"
diff --git a/services/core/java/com/android/server/pm/UserManagerService.java b/services/core/java/com/android/server/pm/UserManagerService.java
index 0f00579051008..4c58b06e79c6f 100644
--- a/services/core/java/com/android/server/pm/UserManagerService.java
+++ b/services/core/java/com/android/server/pm/UserManagerService.java
@@ -221,10 +221,12 @@ public class UserManagerService extends IUserManager.Stub {
 
     private static final int ALLOWED_FLAGS_FOR_CREATE_USERS_PERMISSION =
             UserInfo.FLAG_MANAGED_PROFILE
+            | UserInfo.FLAG_PROFILE
             | UserInfo.FLAG_EPHEMERAL
             | UserInfo.FLAG_RESTRICTED
             | UserInfo.FLAG_GUEST
-            | UserInfo.FLAG_DEMO;
+            | UserInfo.FLAG_DEMO
+            | UserInfo.FLAG_FULL;
 
     @VisibleForTesting
     static final int MIN_USER_ID = UserHandle.MIN_SECONDARY_USER_ID;