The services are deliberately partitioned for a MT instance. As you suggest, if you wish to list all users across all tenants then you could write a custom web script that allows the super admin (an admin user that belongs to the default domain - eg. "admin") to loop through each tenant. You could also filter by tenants that are enabled /disabled, if appropriate.
Regards,
Jan