Can we add a test that verifies that a globaladminonly option cannot be updated by a tenant admin?