Hi @iamology,
Thank you for your suggestion.
I actually started by implementing this logic through the Before Provisioning Rule that SailPoint provides (I’ve attached the PDF reference for context).
Services Standard IdentityNow BeforeProvisioning Rule - README.pdf (68.5 KB)
However, I ran into some issues. Specifically, the account was being disabled successfully, but the entitlements were not getting removed.
I’ve detailed that problem in another post here: https://developer.sailpoint.com/discuss/t/cyberark-saas-connector-account-disables-successfully-but-entitlements-not-removed-when-last-role-is-revoked/186282/1
If you could take a look at that thread, I’ve shared the full configuration and the behaviour I’m observing. Any guidance on resolving that would be really appreciated.