From 12d5bb57c6444f5970e8b5ebd56aba3e1831ad77 Mon Sep 17 00:00:00 2001
From: braginini <bangvalo@gmail.com>
Date: Sat, 31 Jan 2026 16:02:41 +0100
Subject: [PATCH 1/2] Disable local users when LocalAuthDisabled = true

---
 src/interfaces/Account.ts        |  1 +
 src/modules/users/UsersTable.tsx | 55 +++++++++++++++++++++++++-------
 2 files changed, 45 insertions(+), 11 deletions(-)

diff --git a/src/interfaces/Account.ts b/src/interfaces/Account.ts
index 49d55d03..174904e9 100644
--- a/src/interfaces/Account.ts
+++ b/src/interfaces/Account.ts
@@ -24,6 +24,7 @@ export interface Account {
     lazy_connection_enabled: boolean;
     embedded_idp_enabled?: boolean;
     auto_update_version: string;
+    local_auth_disabled?: boolean;
   };
   onboarding?: AccountOnboarding;
 }
diff --git a/src/modules/users/UsersTable.tsx b/src/modules/users/UsersTable.tsx
index 89bd51a3..42d91aaf 100644
--- a/src/modules/users/UsersTable.tsx
+++ b/src/modules/users/UsersTable.tsx
@@ -1,5 +1,6 @@
 import Button from "@components/Button";
 import Card from "@components/Card";
+import FullTooltip from "@components/FullTooltip";
 import InlineLink from "@components/InlineLink";
 import SquareIcon from "@components/SquareIcon";
 import { DataTable } from "@components/table/DataTable";
@@ -319,20 +320,52 @@ export const InviteUserButton = ({
   // On self-hosted: only show when embedded_idp_enabled is true
   const isCloud = isNetBirdHosted();
   const embeddedIdpEnabled = account?.settings.embedded_idp_enabled;
+  const localAuthDisabled = account?.settings.local_auth_disabled;
 
   if (!isCloud && !embeddedIdpEnabled) return null;
 
-  return (
-    <UserInviteModal groups={groups}>
-      <Button
-        variant={"primary"}
-        className={className}
-        disabled={!permission.users.create}
-      >
-        <MailPlus size={16} />
-        {isCloud ? "Invite User" : "Add User"}
-      </Button>
-    </UserInviteModal>
+  const isDisabled = !permission.users.create || localAuthDisabled;
+
+  const button = (
+    <Button
+      variant={"primary"}
+      className={className}
+      disabled={isDisabled}
+    >
+      <MailPlus size={16} />
+      {isCloud ? "Invite User" : "Add User"}
+    </Button>
   );
+
+  if (localAuthDisabled) {
+    return (
+      <FullTooltip
+        className={"ml-auto"}
+        interactive={true}
+        content={
+          <div className={"flex flex-col"}>
+            <p className={"max-w-[200px] text-xs"}>
+              Local authentication is disabled. Adding users locally is not
+              available, use your IdP for authentication.
+            </p>
+            <div className={"text-xs mt-1.5"}>
+              <InlineLink
+                href={"https://docs.netbird.io/selfhosted/identity-providers/disable-local-authentication"}
+                target={"_blank"}
+                className={"flex gap-1 items-center"}
+              >
+                Learn more
+                <ExternalLinkIcon size={12} />
+              </InlineLink>
+            </div>
+          </div>
+        }
+      >
+        {button}
+      </FullTooltip>
+    );
+  }
+
+  return <UserInviteModal groups={groups}>{button}</UserInviteModal>;
 };
 

From 365bd3bde7d83e8de248f4bf8a25b38e0910d92e Mon Sep 17 00:00:00 2001
From: braginini <bangvalo@gmail.com>
Date: Sat, 31 Jan 2026 20:04:48 +0100
Subject: [PATCH 2/2] Code review fixes

---
 src/modules/users/UsersTable.tsx | 5 ++---
 1 file changed, 2 insertions(+), 3 deletions(-)

diff --git a/src/modules/users/UsersTable.tsx b/src/modules/users/UsersTable.tsx
index 42d91aaf..c4d816f7 100644
--- a/src/modules/users/UsersTable.tsx
+++ b/src/modules/users/UsersTable.tsx
@@ -340,13 +340,12 @@ export const InviteUserButton = ({
   if (localAuthDisabled) {
     return (
       <FullTooltip
-        className={"ml-auto"}
+        className={className}
         interactive={true}
         content={
           <div className={"flex flex-col"}>
             <p className={"max-w-[200px] text-xs"}>
-              Local authentication is disabled. Adding users locally is not
-              available, use your IdP for authentication.
+              Local authentication is disabled. Use your IdP for authentication.
             </p>
             <div className={"text-xs mt-1.5"}>
               <InlineLink