Best way to add users to PI for Principal Propagation?

We're working to integrate a .NET application with ECC through PI using principal propagation and assertion tickets.

I've been trying to find some documentation on the best way to maintain the required system accounts in PI for each ECC user with the SAP_XI_APPL_SERV_USER role but so far haven't had much luck. Is it possible to automate this process, or will we need to maintain these accounts manually?

Thanks in advance,

Jon