Seems like someone has played with the default role group assignments in your tenant. On the same page, open the Organization management role and under Permissions, make sure the checkbox next to Role management is ticked. While you're there, wouldn't hurt to also add your own user as member of the role.
ApplicationImpersonation permission on new admin role group
I am attempting to create a new role group with ApplicationImpersonation permissions per https://answers.microsoft.com/en-us/msoffice/forum/all/exchange-impersonation-error-unable-to-open-user/834c4ea9-6cb5-4df4-9011-433ba501f6d2.
When I do so in https://admin.exchange.microsoft.com/#/adminRoles I click Add role group, then name it CloudMigratorImpersonation with default write scope.
Next I add ApplicationImpersonation and Mailbox Import Export permissions, and attempt to assign myself (global admin) to the new role group.
When I click Add Role Group, I get:
Error executing request. You don't have access to create, change, or remove the "professionalartists.onmicrosoft.com\ApplicationImpersonation-CloudMigratorImpersonation" management role assignment. You must be assigned a delegating role assignment to the management role or its parent in the hierarchy without a scope restriction.