User appoval doesn't work

Our tailnet has manual user approval turned on but I still have users being auto created (we use MS as identity provides). What gives ?