At the local level, the system admin can add add/remove/modify users and user groups. At the same time, we have an internet based user management system. The device is registered to the cloud account, allowing users from that account to log in. This allows cloud admin users to manage users/roles centrally for several devices at once.
Here comes the problem: We're trying to encourage people to administer users/roles exclusively from the cloud, but need to keep local user management available for customers that don't want to use it. Local user management has to co-exist with cloud user management on the same devices. Cloud administrators have full access to local user management on all devices, but not vice-versa. Local accounts can't migrate between devices at this time as well.
So finally, the question: How do I visualize this mess so that I can communicate to customers that editing local users only affects users on that device, and not cloud users that have access to that same device? There's so much room for confusion when describing this system.