This technical document describes how to run the Provisioning Manager option "Synchronize user with Roles" via etautil command.
You can write a script to run it to several Global Users.
Identity Manager 14.x
Below the command line
"X:\Program Files (x86)\CA\Identity Manager\Provisioning Server\bin\etautil" -u SUPERUSER -p PASSWORD update 'eTGlobalUserContainerName=Global Users,eTNamespaceName=CommonObjects,dc=im' eTGlobalUser eTGlobalUserName='GU_Name' to eTSyncUsers=1
Where:
SUPERUSER is the user used to login to Provisioning manager
PASSWORD is the super user password
GU_Name is the GU you would like to Sync User with Roles