This is actually already possible although it may not be obvious how it works. Let's say you have the following setup:

• User Steven has role Default
• Role Default has the app Zendesk

Now you want to move Zendesk to a new role called Support.

1. Create a role called Support and add Zendesk to it
2. Edit the user Steven and add the role Support
3. Edit the Default role and remove Zendesk

When you click update without commit changes selected, you will be able to see if anyone will lose a login for the removed apps before you actually make the change. If everything looks okay, select commit changes and update again.