I've raised this with support myself now, and this is the documentation that I was pointed towards:
This is as expected. According to changeset QLIK-72081 the local network UDC is considered unstable and lacks attributes like syncing user attributes (group). Due to this and other priorities, this functionality was removed from 3.2.3 and will be expected to be removed from 4.0.0 for users on the 3.0.x track.
This change in UDC options will not hinder the ability of local users from accessing Qlik Sense either through the Hub or QMC, merely the ability to add local users through a UDC ahead of time. When a local user attempts to authenticate into Qlik Sense, there will still be validation of whether this user exists locally and whether the password entered matches the password for the local user.
The route around this not being present in SR3 onwards is not pretty. When a user hits the site and is authenticated with the local network they are at that point pulled into Sense and you can grant them a token. Until the point they have logged in though this is not available in QMC - making this a two phase thing.
You could after setting up a user then impersonate them to allow the token to be allocated and the connection tested (which isn't a bad thing anyway, I suppose).
Another approach is to set up a User Access rule, so that the token is allocated when a named user tries to access the site - this is tidier. In fact, there is merit in this approach also, in that if you set up access rules for ten people and only eight actually then log into the site then the other two tokens are still available.
Note that there is a seven day quarantine period, so a user logging in once and never coming back will tie up one of your licences for some time.
A final approach, if you have a spare token, is to set up a Login Access rule, and have users come in with a login access on their first attempt and then subsequently allocate them a proper token afterwards.
Hope that this helps people out on this topic.
Steve
