Please consider creating an admin and "super admin" role to protect identity management (users, SSO, billing) from being able to manage the platform (add VMs, dashboards, status pages, etc).