How to not allow Sponsor user to create guest account, only to approve

[iran]

Hi,
I am using guest self-register with sponsor approval.

I have my AD users in this group (Own Group) and I dont want users from this group to be able to create guest users.

I already disabled it:

And the sponsor still able to create accounts:

[Arne Bier]

Interesting use case. Have you tried, under the Sponsor Portal config, configuring an Identity Source Sequence that will prevent the users from logging in? Perhaps some non-sensical sequence.  But that might break the email approval - I have not tried that.

[Arne Bier]

I just tried that - it doesn't work, because the Approve/Deny email contains a link that forces the user to log into the Sponsor Portal. Even when SSO (Kerberos) is enabled for the Sponsor Portal, the link in the email doesn't cause an SSO login.  

[hslai]

See ISE Sponsor Portal Customization - Manage Accounts Page