anchor.diff:  
   * [PCF,PWS: With SSO - centralized end user management supports SSO for multiple apps (easier!)
   
  -####<a id=""></a>Ops Man Admin installs SSO Tile, runs SSO Dashboard, creates service plan that registers various applications, presents dashboard via Okta, etc.
  -
  -####<a id=""></a>Space Manager create instance of service plan and associates End Users via either internal or external store
  +Ops Man Admin installs SSO Tile, runs SSO Dashboard, creates service plan that registers various applications, presents dashboard via Okta, etc.
  +
  +Space Manager create instance of service plan and associates End Users via either internal or external store
   
   * External: SAML or LDAP, which can be different from external user store used for ER Users, above
   
   * Internal UAA: Space Manager associates existing users to plans via SSO dashboard or cf CLI, and create new users via cf CLI ]
  -
  -
  -
  
positive.code: 
  The same person can act as both of these administrators.
  
  ###<a id="ops-man-admin"></a>Ops Manager Administrator
  
  An Ops Manager Admin creates a PCF deployment by deploying Ops Manager onto an infrastructure. When Ops Man boots for the first time, the Ops Man Admin specifies that the deployment draws its user account information from one of two places:
  
  1. An internal UAA database that Ops Manager creates new for the deployment.
  1. An external, existing identity provider accessed via SAML or LDAP protocol
  
  The Ops Manager Admin uses the cf CLI to create [additional Ops Manager Admin](../customizing/opsman-users.html) accounts.
  
  Ops Manager Admins create, operate, and add capabilities to deployments through the Ops Manager Installation Dashboard by installing and configuring tiles for Elastic Runtime and other products and services.
  
  ###<a id="er-admin"></a>Elastic Runtime Administrator
  
  The Elastic Runtime Admin deploys and configures the Elastic Runtime tile, plus product and service tiles that the PCF deployment uses.
  
  The Elastic Runtime Admin configures the Elastic Runtime tile to specify whether the deployment's user account information comes from an internal UAA or from an external identity provider. They can then add user accounts and define Organizations and Spaces within the deployment. These virtual compartments allow [Elastic Runtime users](#er-user) to self-administer user accounts, roles, and permissions within semi-autonomous subsections of the deployment.
  
  <p class="note"><strong>Note</strong>: The internal UAA for Elastic Runtime is the system-wide UAA for storing user information. It differs from the Ops Manager internal UAA, which only stores Ops Manager Admin accounts.</p>
  
  ##<a id="er-user"></a>Elastic Runtime User
  
  The Elastic Runtime user 
  	
  ER Admin defines ER user records in internal ER UAA or external User Store
  	
  you can mainly think of ER Users as developers, but also managers and auditors - see roles below
  
  User roles:
  * associate users with, well, roles (or permissions) in orgs and spaces
  
  * defined by ER Admin in CC DB
  
negative.code: 
  A <%= vars.product_name %> deployment incorporates the following user types:
  
  Operator - highest level
  	ops man admin
  		sets userstore
  		adds products and services, configuration as tiles
  	ERT op admin
  		true statement about where user account comes from if previously set by ops man admin?
  		perhaps that's what the note says
  Elastic Runtime users - broad term for all the roles under ER users
  
  - [Operator](#operator)
  	- [Ops Manager Administrator](#ops-man-admin)
  	- [Elastic Runtime Administrator](#er-admin))
  - [Elastic Runtime User](#er-user)
  	- Org Manager, Org Auditor, Org Billing Manager
  	- Space Manager, Space Developer, Space Auditor
  - [End User](#end-user)
  
  ## <a id='table'></a>User Types Summary
  
  <table id='users-summary' border='1' class='nice'>
  	<tr>
  		<th>User Type</th>
  		<th>Tools They Use</th>
  		<th>Accounts Stored in</th>
  		<th>Users They Manage</th>
  	</tr><tr>
  		<th>Ops Manager Admin</th>
  		<td>PivNet <br>Ops Manager <br>cf CLI <br> UAA CLI (UAAC) <br>SSO Dashboard<br>IaaS UX</td>
  		<td>Ops Manager store via UAA or external store via SAML or LDAP</td>
  		<td>Elastic Runtime Admins</td>
  	</tr><tr>
  		<th>Elastic Runtime Admin</th>
  		<td>PivNet <br> Ops Manager <br>cf CLI<br>Marketplace</td>
  		<td>Elastic Runtime user store via UAA or external store via SAML or LDAP</td>
  		<td>Elastic Runtime Users</td>
  	</tr><tr>
  		<th>Elastic Runtime User</th>
  		<td>cf CLI <br>CAPI <br>Apps Manager <br>Marketplace</td>
  		<td>Elastic Runtime user store via UAA or external store via SAML or LDAP</td>
  		<td>Elastic Runtime Users within permitted orgs and spaces, End Users</td>
  	</tr><tr>
  		<th>End User</th>
  		<td>Hosted Applications</td>
  		<td>Individual applications or  user store via SSO</td>
  		<td></td>
  	</tr>
  </table>
  
  ## <a id="operator"></a>Operator
  
  An operator runs a <%= vars.product_name %> deployment and has the highest-level permissions to configure a deployment, create user accounts, and perform other administrative functions. There are two types of operators:
  
  