...
Aftrer choosing a "legal" user, you get this message:
The SysAdmin will always be able to add users, and the Administrator role will typically be able to do it as well.
If you add users as SysAdmin, you must also assign the user to an agency, whereas as an Administrator, the users agency will automatically be that of the Administrator.
In this case it is the SysAdmin adding users, and an agency for the user should be selected, and Is approved should be checked to give the user access:
To finish click on the Save data button: 
In the column DVI Roles you can see which role the user is assigned to. This reflects the users membership in the Active Directory group, and can not be altered for the individual user.
Locking out a user
You can uncheck the Is approved column to temporarily lock a user out from the system.