This also handles demoting tenant admins