anchor.diff:  
   Using the UAA Command Line Interface (UAAC), an administrator can create users in the User Account and Authentication (UAA) server.
   
  -<p class="note"><strong>Note</strong>: The UAAC only creates users in UAA, and does not assign roles in the Cloud Controller database (CCDB). In general, administrators create users using the Cloud Foundry Command Line Interface (cf CLI). The cf CLI both creates user records in the UAA and associates them with org and space roles in the CCDB. Before administrators can assign roles to the user, the user must log in through Apps Manager or the cf CLI for the user record to populate the CCDB. Review the <a href="./cli-user-management.html">Creating and Managing Users with the cf CLI</a> topic for more information. </p>
  +<p class="note"><strong>Note</strong>: The UAAC only creates users in UAA, and does not assign roles in the Cloud Controller database (CCDB). In general, administrators create users using the Cloud Foundry Command Line Interface (cf CLI). The cf CLI both creates user records in the UAA and associates them with org and space roles in the CCDB. Before administrators can assign roles to the user, the user must log in through Apps Manager or the cf CLI for the user record to populate the CCDB. Review the <a href="./cli-user-management.html">Creating and Managing Users with the cf CLI</a> topic for more information.</p></p>
   
   For additional details and information, refer to the following topics:
   
  
positive.code:     </pre>
  
  ### <a id="admin-read-only"></a> Create an Admin Read-Only User
      
  If you want to create an admin user account with read-only access to Cloud Controller APIs, then perform steps 1 to 8 in [Create an Admin User](#creating-admin-users). Instead of Step 9, run the following commands: 
  <pre class="terminal">
  $ uaac member add cloud_controller.admin\_read\_only Adam
  $ uaac member add uaa.admin Adam
  $ uaac member add scim.read Adam
  </pre>
    
  The admin read-only account can view but not modify all Cloud Controller API resources. 
  
  ### <a id="global-auditor"></a> Create a Global Auditor User
  
  If you want to create an global auditor account with read-only access to Cloud Controller APIs, then perform steps 1 to 8 in [Create an Admin User](#creating-admin-users). Instead of Step 9, run the following command: 
  
  <pre class="terminal">
  $ uaac member add cloud_controller.global_auditor Adam
  </pre>
  
  Like the admin read-only account, the global auditor account is allowed read-only access to all Cloud Controller API resources. The difference is that the global auditor account cannot access secret data such as environment variables. 
  
  For more information about which roles can perform various operations, see the <a href="../concepts/roles.html#roles">Roles and Permissions</a> topic.</p>
  
  ## <a id='external-group'></a>Grant Admin Permissions to an External Group (SAML or LDAP) ##
  
  
negative.code: * [Other UAA Documentation](https://github.com/cloudfoundry/uaa/tree/master/docs)
  
  <p class="note"><strong>Note</strong>: UAAC requires Ruby v2.3.1 or later. If you have an earlier version of Ruby installed, install v2.3.1 or later before using the UAAC.</p>
  
  For more information about which roles can perform various operations in Cloud Foundry, see the <a href="../concepts/roles.html#roles">Roles and Permissions</a> topic.
  
  ## <a id='creating-admin-users'></a>Create an Admin User ##
  
  