After a LOT of trial and error, got the info needed.
First the Admin User (options) can be found in the console; upper right corner where you can select the organization. Then in the organization list, in the project name row, click users, then you can select which ever use you want to Admin and change their privileges.
Then I discovered this
For Admin API requests, your Application ID is the ObjectId value in the _id field, not the client_app_id
This refers to a list retrieved from doing a function call to get all of the apps in the project. e.g. to run admin tasks the app id you would normally use your-app-xxxxxx is not the right one. You will need to discover the application id, not app ID. It’s probably somewhere obvious but I did a little function to list all of the apps within the project and got it from there.