UmbracoCustomOwinStartup.RemoveGroups.cs

private static void RemoveGroups(BackOfficeIdentityUser autoLinkUser, IReadOnlyUserGroup[] groupsToRemove)
{
    // remove old groups
    // for some reason it only works if we adjust the groups first and then the roles.
    // only works when both are changed and only in that order :S
    var groups = autoLinkUser.Groups.ToList();
    foreach (var adGroup in groupsToRemove) groups.RemoveAll(x => x.Alias.Equals(adGroup.Alias));
    autoLinkUser.Groups = groups.ToArray();

    // the same for roles
    foreach (var adGroup in groupsToRemove)
    {
        var userRole = autoLinkUser.Roles.FirstOrDefault(x => x.RoleId.Equals(adGroup.Alias));
        if (userRole == null) continue;

        autoLinkUser.Roles.Remove(userRole);
    }
}