How to properly set up the admin role in my app

this one helps. Fixed it by making sure the Realm setting "Assign Groups" is empty. Glassfish will load them from the Group Table.

This might help you No worries I found it, I had to add pdf to allowed file types in the user manager.

Does that help Move the indicated section of code to the Edit method inside the if(!isAdmin):

    if (!isAdmin)
    {      
        if (editUser.Roles.Exists(x => x.RoleName == "Admin" && x.Checked))
        {
            return RedirectToAction("AccessNotAllowed", "Errors");
        }
        var adm = editUser.Roles
                    .Where(x => x.RoleName.Equals("Admin", StringComparison.OrdinalIgnoreCase))
                    .FirstOrDefault();
        if (adm != null)
        {
            editUser.Roles.Remove(adm);
        }
    }

seems to work fine No, this is not that simple. User cannot give another user privilege higher than he has (it would be a serious security hole). So for example you have role to edit Security roles and you have Read access for Accounts in your Business Units. If somebody in your Business unit has no Read access and only User access, you can add him Read access for Business Unit (the same you have), but you will not be able to give him Organizational access (so higher than yours). You could imagine that if this would be possible, you will be able to basically give yourself Admin privilege and do whatever you want in CRM. Knowing that, it should be possible for you to create a role that for example have full access to Accounts, Contacts, Custom entities etc. and Security Roles. This role would be able to modify other users access levels to Accounts, Contacts etc. but no other entities that they don't have privilege to.
Exactly the same logic applies to assigning the Security Roles. So user A cannot assign a Security Role to user B, if it gives user B privileges higher than has User A.