Provision a login-capable account and assign roles.
New accounts start in Pending activation with a temporary password and must be activated before first login.