Add a "Reprovision All" option that will fire off a specified provisioner for all CO People and CO Groups. This could be done entirely via the UI (albeit potentially slowly), which could pull a list of relevant people/group IDs and then call the provision API for each of them.