After you create a role on an externalized resource, you must use the external security manager to add or remove users and users groups from the role.