Update tenantOverride and globalAdminOnly across the configuration, tweak tests, add docs