AGR_USERS is out of sync with SU01

Hello!

Scenario:

So I'm having to replace roles for about 18 thousand users. We're delpoying the change a few thousand users at a time.

We created a couple of ecatts that first removes all the access and then adds all the new access. The ECATT is setup by placing the roles horizontally across for each user, which assigns all the roles in one change. The issue we've noticed, comes from a few workflow roles that require a confirmation. The ECATT doesn't know what to do and skips the process for that user which fails to delete all access, which in turn, fails to assign all access.

Issue:

When I looked up the AGR_USER table to validate the assignment I noticed the table indicates the user has access, but when I go to SU01for some users the role assignment is missing. From what I can tell, it seems if I reopen the user manually and save, it reflects the change in the AGR table. What I need to know is there a way to mass sync the table to reflect the actual assignments in SU01? Or is there an indicator on the AGR_USER table stating the user is not synced with SU01?

I need to find the users not synced between SU01 and AGR_USERS. Then assign the missing roles. Currently the AGR_USERS table is giving me false positives.

Thanks in advance!

Alex