Because 'roles' are assigned via groups, you have to remove a user from the group which assigns the role to the user in order to remove the role from the user.
Similarly, to add a role to a user, this needs to be done via groups - adding the user to different groups will change the roles which are assigned to them.
Alternatively, you can edit and remove the roles contained within a group to change the roles that the group assigns to users who are members of the group.
The image below shows the relationship of groups to roles and users.
What if the user is a member of multiple groups?
If the specific role you wish to remove is included in multiple groups in your account, you may need to remove the user from more than one group.
* Please be aware that changing the roles attached to the group will affect all members of the group.
How will I know that I've successfully added or removed a role?
To crosscheck that the role changes you make through groups achieve the desired outcome for your user, impersonate their profile.
Article ID: xapimedA_20200203_1