A "hacky" solution could be with location path, like this in web.config:

  <location path="epiui/admin/EditUser.aspx"> 

    <system.web> 

        <authorization> 

             <allow roles="WebAdmins, Administrators" /> 

             <deny users="*" /> 

        </authorization> 

     </system.web> 

  </location>

Or you could inherit from the MembershipProvider, override CreateUser() and add some checks there.

(edited because the code editor messed up a little)

Thanks Magnus, those look pretty good solutions. :-)

But, just to be clear in my own mind, there is no standard functionality in CMS 5 to do this?

No problem.

I don't think there is any functionality like that in EPiServer. But there are lots of support for handling authorization, user rights etc. in ASP.Net anyway... I think EPiServer wants to leave as much as possible to the standard framework, which I wholeheartedly approve. :)