As mentioned, some configuration permutations are effectively the same as others. For example, `globalAdminOnly: true` should always imply `suppress: true`, even if `suppress` were accidentally set to `false`. So `globalAdminOnly: true` is the same as `globalAdminOnly: true, suppress: true`.

That said, I think we can narrow the list of permutations we discuss to:

`{globalAdminOnly: true, tenantOverride: true, suppress: true}` - the use-case of a private identity where you want the tenant to override it (MediaCore integration)
`{globalAdminOnly: true, tenantOverride: false, suppress: true}` - the use-case of a private identity where you don't want the tenant to override (System-wide service provider credentials where custom override is not necessary, such as Google authentication)
`{globalAdminOnly: false, tenantOverride: true, suppress: false}` - Configuration values that are needed by the UI and can be overridden by the tenant administrator, such as default visibility and locales
`{globalAdminOnly: false, tenantOverride: false, suppress: true}` - Global configuration values that don't need to be seen by the UI and shouldn't be overridden by tenant admins, such as the ability to stop their tenant