+1, the following should not be provided on the opts object:

`tenantAlias`: Should be a top-level function parameter: `ctx, tenantAlias, loginId, displayName, opts` as it logically specifies some kind of "container" in which the user is created, not an attribute of the user. For the same reason, `tenantAlias` would not be a querystring parameter either in the REST endpoint, but that actually might not be possible due to conflicts on the URL path, but if we can find an elegant way to represent it as a container rather than a QS parameter I would be for it.

`isGlobalAdmin`: Should still be left as a separate action, not the same action. The thing that tells me that it's not quite right is that if you just toggle a querystring parameter / `opt` property, it will make the difference between return a `200` or a `401`, which shouldn't really happen IMO

`isTenantAdmin`: Same thing for this as well as in `isGlobalAdmin`.