So we know that JIT (just in time) only allows provisioning first time, it doesn’t update or delete, and in SCIM implementation it's also very limited. We allow only deleting a user and changing their name.

It would be best as to assign, change, and sync roles using the identity provider to sync with the PD WS Roles instead of creating a new Role in PD.