Splitting IdP-managed roles from app-only roles is the detail that makes a full replace safe. Ending sessions tied to the dropped role in the same run is a nice touch, otherwise the old token keeps working until expiry.