Policy for allowing SSO users to change only their own information?

Hello,

I'm setting up SSO for my company and our accounts. I want users to be able to change their own information, credentials, access keys, MFA devices, and so on, without having to make them admins (and thus giving them too high privileges) and without having to rely on an admin to do it for them.

Is this possible? What would such an IAM policy look like?

Thank you for taking the time to read.