anchor.diff:  
   Follow this procedure to disable **Invitations**, **Create Account** and **Reset Password** from the Apps Manager console so that users are not allowed to register new accounts.
   
  -1. Launch Apps Manager at `https://apps.{system-domain}`
  +1. Launch Apps Manager at `https://apps.{system-domain}`.
   
   1. Login with admin user credentials.
   
   1. Select your **System** org.
   
  -1. Select your **apps_manager** space and click on the **apps_manager** app.
  +1. Select your **apps_manager** space and click the **apps_manager** app.
   
   1. Select **Environment Variables**.
   
  
positive.code: Associate the user with the appropriate PCF orgs, using the [Organizations API](http://apidocs.cloudfoundry.org/201/organizations/associate_user_with_the_organization.html).
  
  
  ### <a id='user-space-role'></a>Step 3: Associate User with Space Role ##
  
  - Associate Auditor with the Space, using the [Spaces API](http://apidocs.cloudfoundry.org/201/spaces/associate_auditor_with_the_space.html).
  - Associate Developer with the Space, using the [Spaces API](http://apidocs.cloudfoundry.org/201/spaces/associate_developer_with_the_space.html).
  
negative.code: 
  ## <a id='onboard-users'></a>Step 2: Onboard LDAP Users ##
  
  <p class='note'><strong>Note</strong>: Do not create new users in Pivotal Cloud Foundry via CF CLI, by UAAC, or by using invitations in Apps Manager. This will create a user identity in the internal user store separate from the LDAP user identity. Follow the procedure described here instead.</p>
  
  LDAP Users can be onboarded in two ways:
  
  