# Best way to disable an account once roles are removed

**URL:** <https://developer.sailpoint.com/discuss/t/best-way-to-disable-an-account-once-roles-are-removed/164130>\
**Category:** SHF Discussion and Questions\
**Tags:** access-requests, workflows, roles, identity-security-cloud, connectors, provisioning\
**Created:** [August 5, 2025, 5:23am UTC](https://developer.sailpoint.com/discuss/t/best-way-to-disable-an-account-once-roles-are-removed/164130 "2025-08-05T05:23:13Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![jrossicare](https://avatars.discourse-cdn.com/v4/letter/j/a698b9/32.png) [@jrossicare](https://developer.sailpoint.com/discuss/u/jrossicare)\
**Post date:** [August 5, 2025, 5:23am UTC](https://developer.sailpoint.com/discuss/t/best-way-to-disable-an-account-once-roles-are-removed/164130/1 "2025-08-05T05:23:13Z")

</div>

Hi

What is the best way to automatically disable an account once a user has no more roles for this source?

Is it workflow? or are there other methods?

Example would be say SalesForce or Web Service source. Say roles are requestable, so when roles are revoked, and the user has no more roles for this source, we want to disable their account.

Thank you

---

<div class="post-metadata">

**Author:** ![schattopadhy](https://sea1.discourse-cdn.com/sailpoint/discuss/user_avatar/developer.sailpoint.com/schattopadhy/32/8854_2.png) [@schattopadhy](https://developer.sailpoint.com/discuss/u/schattopadhy)\
**Post date:** [August 5, 2025, 5:58am UTC](https://developer.sailpoint.com/discuss/t/best-way-to-disable-an-account-once-roles-are-removed/164130/2 "2025-08-05T05:58:31Z")

</div>

> [@jrossicare](#):
>
> source. Say roles are requestable, so when roles are revoked, and the user has no more roles for this source, we want to disable their account.

@jrossicare before rule can probably work well here which can be triggered on entitlement removal

---

<div class="post-metadata">

**Author:** ![rohit\_wekhande](https://sea1.discourse-cdn.com/sailpoint/discuss/user_avatar/developer.sailpoint.com/rohit_wekhande/32/28501_2.png) [@rohit\_wekhande](https://developer.sailpoint.com/discuss/u/rohit_wekhande)\
**Post date:** [August 5, 2025, 6:06am UTC](https://developer.sailpoint.com/discuss/t/best-way-to-disable-an-account-once-roles-are-removed/164130/3 "2025-08-05T06:06:18Z")

</div>

Hello,

You can use a before provisioning cloud rule for the source which will check for remove entitlement request and also, it will look into respective identity of the user whether it has any roles assigned, if no, you can trigger an Account Disable Request.

---

<div class="post-metadata">

**Author:** ![jrossicare](https://avatars.discourse-cdn.com/v4/letter/j/a698b9/32.png) [@jrossicare](https://developer.sailpoint.com/discuss/u/jrossicare)\
**Post date:** [August 5, 2025, 6:47am UTC](https://developer.sailpoint.com/discuss/t/best-way-to-disable-an-account-once-roles-are-removed/164130/4 "2025-08-05T06:47:33Z")

</div>

Thanks both, before rule seems better way to go than workflow.

---

<div class="post-metadata">

**Author:** ![system](https://global.discourse-cdn.com/sailpoint/original/2X/f/f2136700ed5e3703e0b85e02f6be799dacca7735.png) [@system](https://developer.sailpoint.com/discuss/u/system)\
**Post date:** [October 4, 2025, 6:48am UTC](https://developer.sailpoint.com/discuss/t/best-way-to-disable-an-account-once-roles-are-removed/164130/5 "2025-10-04T06:48:27Z")

</div>

This topic was automatically closed 60 days after the last reply. New replies are no longer allowed.