When and how to create users in a MongoDB sharded cluster
Tutorial Deploy Sharded Cluster with Keyfile Authentication provides a step-by-step setup for a sharded cluster with authentication, i.e. creating users.
The general procedure is this:

Deploy the entire sharded cluster completely without any user accounts.
When the cluster is complete connect to one mongos (using localhost exception) and create the user accounts. The accounts will be available in the entire cluster.
Connect locally to each shard (i.e. the PRIMARY node, using localhost exception) and create the &quot;shard-local administrator&quot; accounts.

Step 2 and 3 you can exchange, if you like.
What is a &quot;shard-local administrator&quot; account?
User accounts are (usually) defined in the admin database of the Config Servers. When a client connects to the cluster then it queries the config server to validate the credentials. Some operational tasks on the shard servers requires a direct (i.e. local) connection to the shard server, sometimes they are even disconnected from the cluster. A disconnected shard node cannot query the Config Server in order to validate any credentials.
For this reason you have to create the &quot;shard-local administrator&quot; accounts on each shard. With this account you can connect locally to the shard server and perform some maintenance operations even when it is not connected to the cluster. The accounts are created on the PRIMARY nodes and they are replicated to the SECONDARIES.
The &quot;shard-local administrator&quot; accounts are needed only for some operational task, your application does not require any of them.
The Config Server does not have such local accounts, because
local users are equal to cluster users. You can use the cluster user credential also to connect directly (i.e. locally) to a Config server.
The mongos does not have such local accounts either. The mongos does not store any data locally, thus operational tasks mentioned above does not exist and local accounts are not required nor possible.
When you add new shard replica sets then you also have to create the &quot;shard-local administrator&quot; accounts on them. However, it does not matter when you create it, because they are fully independent from any cluster user.