BTW when the instance is set to on-demand users can still lock down federation for themselves, and when federation is enabled they can set themselves to on-demand or disabled. This is currently the only exception to all admin settings being fully overridable by users.

BTW when the instance is set to on-demand users can still lock down federation for themselves, and when federation is enabled they can set themselves to on-demand or disabled. This is currently the only exception to all admin settings being fully overridable by users [besides the more obvious ones in "instance configuration" such as instance name and max file upload size].