I have some users who have an entitlement to be in a group. However
somehow,somebody, has manually removed them from the group.

How can I regenerate the provisioning of the group membership based on a
role that is already granted?

thanks