User can not be removed from the UI if the user has no roles (the roles field is empty). The reason is the client pm restriction check for roles diff done in the user controller. Missing there is check for empty user roles.