# Active directory entitlement removal

**URL:** <https://developer.sailpoint.com/discuss/t/active-directory-entitlement-removal/19244>\
**Category:** SHF Discussion and Questions\
**Tags:** lifecycle-management, sailpoint-identity-security\
**Created:** [October 17, 2023, 1:21pm UTC](https://developer.sailpoint.com/discuss/t/active-directory-entitlement-removal/19244 "2023-10-17T13:21:29Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![Harish\_accenture](https://avatars.discourse-cdn.com/v4/letter/h/ce73a5/32.png) [@Harish\_accenture](https://developer.sailpoint.com/discuss/u/Harish_accenture)\
**Post date:** [October 17, 2023, 1:21pm UTC](https://developer.sailpoint.com/discuss/t/active-directory-entitlement-removal/19244/1 "2023-10-17T13:21:29Z")

</div>

Can anyone help me in this scenario? I need to remove all the access of Active Directory as soon as the user’s LCS state is set to ‘Lapsed.’ I’m already using a ‘Before provisioning’ rule to move users from their current OU to the ‘Lapsed’ OU. Is it possible to add the access removal code to the same ‘Before provisioning’ rule?

Thanks,  
Harish G

---

<div class="post-metadata">

**Author:** ![KRM7](https://sea1.discourse-cdn.com/sailpoint/discuss/user_avatar/developer.sailpoint.com/krm7/32/2685_2.png) [@KRM7](https://developer.sailpoint.com/discuss/u/KRM7)\
**Post date:** [October 17, 2023, 1:34pm UTC](https://developer.sailpoint.com/discuss/t/active-directory-entitlement-removal/19244/2 "2023-10-17T13:34:19Z")

</div>

You need to check how the access is Granted to user in the first place ?

If it is Role criteria, then user will get the access back. Make sure you add LCS as well to your Role assignment criteria.

If it is Access Request, then if you remove just access (entitlements), since user has Role/Access Profile, user will get it back.

I would suggest to use Workflow to remove all the Roles/AP.

---

<div class="post-metadata">

**Author:** ![KRM7](https://sea1.discourse-cdn.com/sailpoint/discuss/user_avatar/developer.sailpoint.com/krm7/32/2685_2.png) [@KRM7](https://developer.sailpoint.com/discuss/u/KRM7)\
**Post date:** [October 17, 2023, 1:47pm UTC](https://developer.sailpoint.com/discuss/t/active-directory-entitlement-removal/19244/3 "2023-10-17T13:47:02Z")

</div>

Look into this, it might help you.

[Workflow to remove ALL leavers’ standing access - IdentityNow (IDN) / IDN Show and Tell - SailPoint Developer Community Forum](https://developer.sailpoint.com/discuss/t/workflow-to-remove-all-leavers-standing-access/13025)

---

<div class="post-metadata">

**Author:** ![Harish\_accenture](https://avatars.discourse-cdn.com/v4/letter/h/ce73a5/32.png) [@Harish\_accenture](https://developer.sailpoint.com/discuss/u/Harish_accenture)\
**Post date:** [October 25, 2023, 6:27am UTC](https://developer.sailpoint.com/discuss/t/active-directory-entitlement-removal/19244/4 "2023-10-25T06:27:08Z")

</div>

Hi @KRM7 ,

Thank you for your reply. I need to remove the entitlements assigned by the AD team. I believe the current workflow does not support the removal of entitlements. I have tried using the code below in conjunction with the movers code, but it doesn’t seem to be working as expected.

String lcsState = null;  
boolean moveOUADFlag = false;

```
public AttributeRequest newAttributeRequestRemove(String attributeName, Object attributeValue){ 
  AttributeRequest attributeRequest = new ProvisioningPlan.AttributeRequest(); 
  attributeRequest.setName(attributeName); 
  attributeRequest.setOperation(ProvisioningPlan.Operation.Remove); 
  attributeRequest.setValue(attributeValue);
  return attributeRequest; 
}

log.info("Entering into the code");
if(plan != null){
	Identity identity = plan.getIdentity();
	lcsState = identity.getAttribute("cloudLifecycleState");
	log.info("Fetching cloudLifecycleState");
	for(AccountRequest accountRequest : plan.getAccountRequests()){
	
	sailpoint.object.Identity identity = plan.getIdentity();
	
	    if(accountRequest.getOp().equals(ProvisioningPlan.ObjectOperation.Modify)){
		    log.debug("Entering the loop");
           List attributes = accountRequest.getAttributeRequests();
		   log.debug("Get Attribute request");
		   String nativeIdentity = accountRequest.getNativeIdentity();
		   String appName = accountRequest.getApplication();
           for(AttributeRequest attribute : attributes){
		      if(attribute.getName().equals("description")){
				moveOUADFlag = true;
				log.debug("Setting the description flag to true");
			  }
				   }			   
		   if(lcsState != null && !lcsState.isEmpty()){
		        if(moveOUADFlag && lcsState.equalsIgnoreCase("lapsed")){
				
					 accountRequest.add(new AttributeRequest("AC_NewParent", ProvisioningPlan.Operation.Set, "OU=Lapsed,OU=Staff,OU=Sandbox,OU=IDM,DC=,DC=local"));
					 log.debug("Moving to Lapsed OU");
					 
				Account adAccount = idn.getAccountByNativeIdentity(appName, nativeIdentity);
			 Map attributes = adAccount.getAttributes(); 
			 Object accountGroups = attributes.get("memberOf");
			  if(accountGroups != null) {
				  List removeList = new ArrayList();
				   accountRequest.add(newAttributeRequestRemove("memberOf", removeList));
			  }
			}	

			   }
		   }
		}
	
}

```

Thanks,  
Harish G

---

<div class="post-metadata">

**Author:** ![system](https://global.discourse-cdn.com/sailpoint/original/2X/f/f2136700ed5e3703e0b85e02f6be799dacca7735.png) [@system](https://developer.sailpoint.com/discuss/u/system)\
**Post date:** [December 24, 2023, 6:27am UTC](https://developer.sailpoint.com/discuss/t/active-directory-entitlement-removal/19244/5 "2023-12-24T06:27:39Z")

</div>

This topic was automatically closed 60 days after the last reply. New replies are no longer allowed.