Tvasilovic, you are correct this is a setting within the Admin Console underneath the Products area. We have that function turned off for the reasons you note as we have users request access to any system via a process our IT teams require in a ServiceNow system. Once those requests are reviewed and approved, as WF admins we'll go into Admin Console, add the user and then update access, etc. within WF. It assures the user gets access to only the system(s) approved via the SN process.