http://mms.mongodb.com/help/reference/authentication/#mms-monitoring

This page should explain that the credentials for the MMS agent on a sharded cluster need to be manually propagated down to the shard replica-sets. This step is not required for normal clients because auth normally happens via the config servers.

A user can be added to the replica-sets directly via the localhost exception on the respective primaries.

The page should also reference the warning (before the step above) that the first user created in each replica-set should be able to create other users. The second user created should be the monitoring agent auth.