@rjayaraman I just did an experiment in my sandbox. I changed e-mails for three employees, mapped the fields internal id, give access (Yes), password, confirm password, and require password change (Yes). My advanced options were to NOT check overwrite sublists and NOT overwrite missing fields. That worked. I logged in using the new email and temp password and it prompted me to change my password. I then did the same thing with give access (No) and it did remove the roles.