Service Control Policies vs User policies

If the SCP is applied to the account with a condition that no one can create or terminate EC2 instances AND there is a user policy applied to the user which allows the user to create or terminate the EC2 then which one is given the preference ? Thank You.

Basically which one has the priority SCP or User level policies via IAM ?