The rules section also covers question 2 in your extension mobility question in another message.
Generally people just set the default user role in the rules and sync the users in. CUCM has no concept of user roles so we have to assign a default. I am not 100% sure but once you have created the user in PCP, re-syncing with a new rule may not change the role to a new role. Some options that come to mind are to manually update the user with a new role, use a batch to update the users role or remove the domain (make sure you don't remove the users from CUCM!), recreate and resync.
If you are concerned about assigning multiple roles to different people in a domain there may be some tricks to get this done:
-- Domain sync. If you have users that match the dept number, device pool or location setting that would have different roles, you could try setting up a domain, setting for example a dept # to bring in doctors with a doctor role, then switch the domain criteria to a different dept # for nurses. This might be a way to get doctors and nurses into a domain together with different roles. Once synced, you would change the sync setting to existing users for subsequent syncs.
-- LDAP sync. If you have an LDAP server, you can setup PCP to do the initial add of users into PCP using the LDAP filters and let the User Role filter do the assignment of roles based on LDAP query characteristics. In this case you would assure the user role configuration in PCP has automatic service provisioning disabled as you just want to add the userIDs into PCP with the correct roles. Once the users are created in PCP, you can set the domains to existing user sync and perform the domain sync. PCP will see the userID in PCP and pull in the users services from the pool of subscriber synced information that matches that userID. The result is a bunch of users with their new roles and services in the User Records.
-- Import Users. Again you need to start with an empty domain and use the example file provided in the Import Users button in the User Provisioning UI. Make sure automatic service provisioning is turned off in the user roles for the domain and just use the example file to just create a bunch of userIDs with roles and some basic info. Just as in the LDAP method above, you will be creating just userIDs then do a existing user domain sync to gather the matching services found during the Subscriber Sync process.
-- Multiple Domains. As you touched on already, you could create different domain groups for different role imports. Once the users are in, you could shuffle them around using the move user function to get a mix of different users with different roles into the domains you want them in. This might be ok to do if you have 10s or maybe a couple hundred users to shuffle around but probably would not be practical to move around 10K users (move can be a slow process in large numbers).
I cannot guarantee these will get you what you want but based on what I know about how the product operates, at least one of these tricks may prevent some of the role reassignment you are faced with. I am not sure if anyone has thought about these methods as you would need to be pretty familiar with PCP to understand how these processes work. I suggest you try out in a lab or just on one very controlled domain before trying across a larger UC environment. TAC or a product TME may be helpful to discuss this with.
