Add entitlement and Modify account events are triggered after the disabled account event though it is not configured (in SailPoint identity now)

Identity Security Cloud (ISC) ISC Discussion and Questions
10

I am not sure whether I’m missing something here, because on your earlier comment you said there is no birthright roles, but in the latest response I can see the role is configured with membership criteria which obviously considered as birthright role to the identities who is matching with the criteria. Considering that you have a birthright role, you can try the below options

  1. Add another criteria to unassing this role from identities to remove the entitlement during delete process. This may be an attribute which decides the delete operation.
  2. Attach the Access Profile to the role instead of direct Entitlement which I can see you already tried and its working.
  3. Check whether this issue occurs to all identities or intermittent, if it is intermittent, check the aggregation schedule and there might be a chance the accounts are deleted before the role revocation completed.
  4. Workflow Option: You can refer Workflow to remove ALL leavers' standing access and use GetAccess and ManageAccess Workflow actions to remove the specific entitlement.