The JC agent does its thing by creating local users, groups, etc. -- writing to the local directory service & storage. That's not always desirable.
Case 1: We have network home directories, group storage, shared applications. We don't want or need local accounts on devices, we just need authentication & authorization, to give a user access to the resources on the network. Thin clients are a bit passé, I know, but there are valid uses, especially when we have an SSO engine.
Case 2: We have a database server that can use macOS directory services for authentication & authorization. It uses user accounts for authentication, and user or group for authorization -- and it's much more convenient to manage group permissions in the databases, because that ultimately enables us to control database authorization via JC. We don't want local user accounts or home directories on this server, as we don't want to allow local logins.
