add/remove Users to roles in a Tenant