It is mostly automated and a little tiny bit of manual work.  The import module I wrote takes care of the majority of the user roles (based on what department or branch they are in, their job title, etc), but there is some manual work (very little, really) that the portal administrator takes care of on an individual basis.  I never remove roles during an import, but I do flag the user as potentially no longer needing them (if their job title, location, etc changed). 

The problem with the active directory was that when I first tested it, it created all sorts of nasty security roles that we didn't want on the intranet and just flat out didn't apply to it.  It is a lot easier to have our own set of roles and maintain those separately, though again, most of them are automated through my import module.