# BeforeProvisioning Rule for Oracle EPM to delete the account while removing last entitlement

**URL:** <https://developer.sailpoint.com/discuss/t/beforeprovisioning-rule-for-oracle-epm-to-delete-the-account-while-removing-last-entitlement/141452>\
**Category:** SHF Discussion and Questions\
**Tags:** rules, sailpoint-identity-security, connectors\
**Created:** [June 5, 2025, 5:46am UTC](https://developer.sailpoint.com/discuss/t/beforeprovisioning-rule-for-oracle-epm-to-delete-the-account-while-removing-last-entitlement/141452 "2025-06-05T05:46:14Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![Saipreeti](https://avatars.discourse-cdn.com/v4/letter/s/a698b9/32.png) [@Saipreeti](https://developer.sailpoint.com/discuss/u/Saipreeti)\
**Post date:** [June 5, 2025, 5:46am UTC](https://developer.sailpoint.com/discuss/t/beforeprovisioning-rule-for-oracle-epm-to-delete-the-account-while-removing-last-entitlement/141452/1 "2025-06-05T05:46:14Z")

</div>

We are using " Oracle EPM Cloud - FCCS SAAS" connector.

The connector has one limitation that when we try to revoke the last IDCS group then it throws below error.  
_[“Request to remove all assigned IDCS entitlements of the user was rejected”,“because this will result in deleting the user. \u0027Delete\u0027 the user to achieve the same behaviour.”]_

In certain scenarios, we want to remove their full oracle EPM access. So, we thought of writing a BeforeProvisioning Rule to ‘delete’ the account while removing the last entitlement.

The question that I have is how to achieve this? Which class in ‘sailpoint.object’ package returns entitlements associated to an account because we want to check the count of entitlements to trigger delete operation.

---

<div class="post-metadata">

**Author:** ![KRM7](https://sea1.discourse-cdn.com/sailpoint/discuss/user_avatar/developer.sailpoint.com/krm7/32/2685_2.png) [@KRM7](https://developer.sailpoint.com/discuss/u/KRM7)\
**Post date:** [June 5, 2025, 8:10am UTC](https://developer.sailpoint.com/discuss/t/beforeprovisioning-rule-for-oracle-epm-to-delete-the-account-while-removing-last-entitlement/141452/2 "2025-06-05T08:10:11Z")

</div>

You should consider Service Standard Before Provisioning Rule, developed by SailPoint.

[IdentityNow Mock Project - Compass](https://community.sailpoint.com/t5/Working-With-Services-Knowledge/IdentityNow-Mock-Project/ta-p/208216)

---

<div class="post-metadata">

**Author:** ![jesvin90](https://sea1.discourse-cdn.com/sailpoint/discuss/user_avatar/developer.sailpoint.com/jesvin90/32/5301_2.png) [@jesvin90](https://developer.sailpoint.com/discuss/u/jesvin90)\
**Post date:** [June 5, 2025, 12:28pm UTC](https://developer.sailpoint.com/discuss/t/beforeprovisioning-rule-for-oracle-epm-to-delete-the-account-while-removing-last-entitlement/141452/3 "2025-06-05T12:28:59Z")

</div>

Agree with @KRM7.

The Entitlement Cardinality Update Triggers is designed for your use case.

 ![image](https://global.discourse-cdn.com/sailpoint/original/3X/9/2/92ecb76cd40180c6e98775001ba43f29a7e0b62a.png)

---

<div class="post-metadata">

**Author:** ![Saipreeti](https://avatars.discourse-cdn.com/v4/letter/s/a698b9/32.png) [@Saipreeti](https://developer.sailpoint.com/discuss/u/Saipreeti)\
**Post date:** [June 10, 2025, 11:16am UTC](https://developer.sailpoint.com/discuss/t/beforeprovisioning-rule-for-oracle-epm-to-delete-the-account-while-removing-last-entitlement/141452/4 "2025-06-10T11:16:38Z")

</div>

Thank you @KRM7 and @jesvin90 for replying.  
The delete operation should happen for 2 conditions in the beforeProvisioningRule.

- When user is terminated
- When the last group is removed

My question is if I use “The Entitlement Cardinality Update Triggers”, how do I exactly check the condition at line 48 and 56?  
Or “update triggers” can be used only with “Services Standard BeforeProvisioning Rule”

 ![image](https://global.discourse-cdn.com/sailpoint/original/3X/a/2/a2877dea1b544c52cee9543d7ea27eaab9af707a.png)

---

<div class="post-metadata">

**Author:** ![KRM7](https://sea1.discourse-cdn.com/sailpoint/discuss/user_avatar/developer.sailpoint.com/krm7/32/2685_2.png) [@KRM7](https://developer.sailpoint.com/discuss/u/KRM7)\
**Post date:** [June 10, 2025, 12:08pm UTC](https://developer.sailpoint.com/discuss/t/beforeprovisioning-rule-for-oracle-epm-to-delete-the-account-while-removing-last-entitlement/141452/5 "2025-06-10T12:08:30Z")

</div>

You can add this below config, under **Source Config → connectorAttributes** , You do not need to touch SSBP Rule

- Event config1 deletes account when last entitlement (groups, you need to change this to your entitlement attribute name)
- Event config2 deletes account when user LCS changes to inactive and disable operation on account which you might have configured already under **Identity Profile → Provisioning → Inactive–\> Sources to Disable**

I used 1st event config many times, not the 2nd one yet, test it out.

```auto
"cloudServicesIDNSetup": {
            "eventConfigurations": [
                {
                    "eventActions": [
                        {
                            "Action": "ChangeOperation",
                            "Value": "Delete"
                        }
                    ],
                    "Operation": "Modify",
                    "Entitlement Cardinality Update Triggers": [
                        {
                            "Attribute": "groups",
                            "Operation": "LastRemoved"
                        }
                    ]
                },
				{
                    "eventActions": [
                        {
                            "Action": "ChangeOperation",
                            "Value": "Delete"
                        }
                    ],
                    "Identity Attribute Triggers": [
                        {
                            "Attribute": "cloudLifecycleState",
                            "Value": "inactive",
                            "Operation": "eq"
                        }
                    ],
                    "Operation": "Disable"
                }
            ]
        }

```

---

<div class="post-metadata">

**Author:** ![system](https://global.discourse-cdn.com/sailpoint/original/2X/f/f2136700ed5e3703e0b85e02f6be799dacca7735.png) [@system](https://developer.sailpoint.com/discuss/u/system)\
**Post date:** [August 9, 2025, 12:09pm UTC](https://developer.sailpoint.com/discuss/t/beforeprovisioning-rule-for-oracle-epm-to-delete-the-account-while-removing-last-entitlement/141452/6 "2025-08-09T12:09:16Z")

</div>

This topic was automatically closed 60 days after the last reply. New replies are no longer allowed.