How to restrict Dynamics CRM users changing their own business unit?

I want to restrict users updating Business unit field on their user profiles.

Which settings inside security roles should I change in order to achieve this?

Currently users can change their business unit.