Hi Maarten,
“Update Network” replicates all roles from the main site to all subsites of the network and fully overwrites existing subsites roles. Currently it’s not possible to replicate just part of the roles and do not remove roles which does not exist at the main site.
It’s a subject of a future development – may be next year.
