I think we agreed that making a user a tenant admin should be a separate dedicated request. Making a user a global admin should use the separate global admin creation endpoint.