When a site (like ours) is SSO, non-global admins should not be allowed to "Create User" since those are added as local users and not SSO users creating much confusion. Location and Group admins need ability to "Manage Users" since this is how users get more priv to Resource Groups, but having the button there is too temping for our Location and Resource admins when they don't find the person who needs to be added to their Resource group, then when the users logs in with SSO, they still don't have access to the resource group since their account (even though it looks the same) is a "Forms" account and not an "SSO" account.