Creating users only from the "Users & Databases" page, without the option to modify roles is...less than ideal. At the very least my doadmin user should default with userAdminAnyDatabase role so I am able to implement proper RBAC for my application users.