# Business role with assignment rule assigned back after revoke in certification

**URL:** <https://developer.sailpoint.com/discuss/t/business-role-with-assignment-rule-assigned-back-after-revoke-in-certification/213584>\
**Category:** IIQ Discussion and Questions\
**Tags:** workflows, revocation, certifications, identityiq\
**Created:** [June 15, 2026, 2:17pm UTC](https://developer.sailpoint.com/discuss/t/business-role-with-assignment-rule-assigned-back-after-revoke-in-certification/213584 "2026-06-15T14:17:59Z")\
**Posts on this page:** 20\
**Page:** 1

<div class="post-metadata">

**Author:** ![Rana123H](https://avatars.discourse-cdn.com/v4/letter/r/fbc32d/32.png) [@Rana123H](https://developer.sailpoint.com/discuss/u/Rana123H)\
**Post date:** [June 15, 2026, 2:17pm UTC](https://developer.sailpoint.com/discuss/t/business-role-with-assignment-rule-assigned-back-after-revoke-in-certification/213584/1 "2026-06-15T14:17:59Z")

</div>

## Which IIQ version are you inquiring about?

_sailpoint iiq 8.5_

## Hi All,

## if any business role revoked as part of certification and that business role then it will getting assigned back to identity when new refresh is ruining.

Is there any way where we can make the config changes in iiq to avoid this situation.  
Please help me to make the config change.

And also can we revoke 1 IT role, if multiple IT role associated with business role.

Thanks in advance.

---

<div class="post-metadata">

**Author:** ![naveenkumar3](https://sea1.discourse-cdn.com/sailpoint/discuss/user_avatar/developer.sailpoint.com/naveenkumar3/32/39339_2.png) [@naveenkumar3](https://developer.sailpoint.com/discuss/u/naveenkumar3)\
**Post date:** [June 15, 2026, 2:57pm UTC](https://developer.sailpoint.com/discuss/t/business-role-with-assignment-rule-assigned-back-after-revoke-in-certification/213584/2 "2026-06-15T14:57:07Z")

</div>

**Part 1: Business Role Re-assignment After Certification Revocation**

When a Business Role is revoked via certification, IIQ triggers deprovisioning of that role and its associated IT roles/entitlements. The re-assignment on subsequent Identity Refresh occurs due to one of these conditions:

- **Optimistic Provisioning is enabled** — IIQ marks the provisioning as successful without confirming the connector actually removed it. The role remains on the identity cube. On next refresh with _Provision Assignments_ checked, IIQ sees an active role assignment and re-provisions it.
- **Application was unavailable** during deprovisioning — the removal failed silently or was queued but not completed, leaving the role still attached to the identity.
- **“Provision Assignments” checkbox is selected on the Identity Refresh task** — this is the key trigger. If the role is still logically attached (due to either reason above), refresh treats it as a valid assignment and pushes it back.

**Config fixes:**

| Option | Action |
| --- | --- |
| Optimistic Provisioning | Set to `false` on the application — IIQ will wait for connector confirmation before marking deprovisioning complete |
| Identity Refresh Task | Uncheck **“Provision Assignments”** if you don’t need refresh to drive provisioning |
| Certification Revocation | Ensure the revocation actually clears the role from the identity cube — check `IdentityEntitlement` and `Links` post-revocation |
| Retry Logic | If deprovisioning fails, ensure the provisioning transaction shows a failed/retry state, not success |

* * *

**Part 2: Revoking One IT Role When Multiple IT Roles Are Attached to a Business Role**

you cannot selectively revoke a single IT role from within a Business Role construct via certification\*\*. Certification operates at the Business Role level; all associated IT roles are bundled.

The approach:

1. Revoke the Business Role from the identity via certification or lifecycle event
2. Modify the Business Role definition — remove the unwanted IT role, retain the required one
3. Re-assign the Business Role to the identity

This gives you the correct end state without leaving orphaned IT role assignments. There is no supported out-of-the-box mechanism to cherry-pick one IT role out of a Business Role for a specific identity without role restructuring.

---

<div class="post-metadata">

**Author:** ![Rana123H](https://avatars.discourse-cdn.com/v4/letter/r/fbc32d/32.png) [@Rana123H](https://developer.sailpoint.com/discuss/u/Rana123H)\
**Post date:** [June 15, 2026, 5:23pm UTC](https://developer.sailpoint.com/discuss/t/business-role-with-assignment-rule-assigned-back-after-revoke-in-certification/213584/3 "2026-06-15T17:23:53Z")

</div>

Thanks for response Naveen, appreciate it.

Do i need to change workflow to set Optimistic Provisioning false?

yes, refresh task checkbox is getting back assigned the role.  
i have do the testing in QA environment when i revoke the access from the certification, it had removed that role but when i run the refresh task its assigned back.

in assignment rule, we are using match list, based on match list attribute it getting assign back in refresh.

---

<div class="post-metadata">

**Author:** ![neel193](https://sea1.discourse-cdn.com/sailpoint/discuss/user_avatar/developer.sailpoint.com/neel193/32/34038_2.png) [@neel193](https://developer.sailpoint.com/discuss/u/neel193)\
**Post date:** [June 15, 2026, 6:45pm UTC](https://developer.sailpoint.com/discuss/t/business-role-with-assignment-rule-assigned-back-after-revoke-in-certification/213584/4 "2026-06-15T18:45:16Z")

</div>

@Rana123H Optimistic Provisioning should not impact role removal. Normally business role removes immediately. Could you please do this, capture the identity xml of a user → revoke a role → capture the identity xml again.

For your second case, you should split your business roles into manageable chunks where you can remove any role easily during certification.

---

<div class="post-metadata">

**Author:** ![naveenkumar3](https://sea1.discourse-cdn.com/sailpoint/discuss/user_avatar/developer.sailpoint.com/naveenkumar3/32/39339_2.png) [@naveenkumar3](https://developer.sailpoint.com/discuss/u/naveenkumar3)\
**Post date:** [June 16, 2026, 3:17am UTC](https://developer.sailpoint.com/discuss/t/business-role-with-assignment-rule-assigned-back-after-revoke-in-certification/213584/5 "2026-06-16T03:17:48Z")

</div>

No, I said if the flag is set to true, In your case if the flag is not set to true, don’t do anything, there wont be any impact.

---

<div class="post-metadata">

**Author:** ![r\_pragati](https://avatars.discourse-cdn.com/v4/letter/r/41988e/32.png) [@r\_pragati](https://developer.sailpoint.com/discuss/u/r_pragati)\
**Post date:** [June 16, 2026, 3:54am UTC](https://developer.sailpoint.com/discuss/t/business-role-with-assignment-rule-assigned-back-after-revoke-in-certification/213584/6 "2026-06-16T03:54:28Z")

</div>

@Rana123H - it is possible that the business role is getting assigned due to the assignment rule? can you please share the bundle XML?

---

<div class="post-metadata">

**Author:** ![Rana123H](https://avatars.discourse-cdn.com/v4/letter/r/fbc32d/32.png) [@Rana123H](https://developer.sailpoint.com/discuss/u/Rana123H)\
**Post date:** [June 16, 2026, 7:28am UTC](https://developer.sailpoint.com/discuss/t/business-role-with-assignment-rule-assigned-back-after-revoke-in-certification/213584/7 "2026-06-16T07:28:03Z")

</div>

Hi @r_pragati ,

Here is bundle XML.

`<?xml version='1.0' encoding='UTF-8'?>`  
`<!DOCTYPE Bundle PUBLIC "sailpoint.dtd" "sailpoint.dtd">`  
`<Bundle created="1720539677116" displayName="Mobile Developer" id="0a05661e904b1b578190982801bc7593" modified="1720539871422" name="Mobile Developer" type="business">`  
`<Attributes>`  
`<Map>`  
`<entry key="accountSelectorRules"/>`  
`<entry key="allowDuplicateAccounts" value="false"/>`  
`<entry key="allowMultipleAssignments" value="false"/>`  
`<entry key="mergeTemplates" value="false"/>`  
`<entry key="qrgApplicationName"/>`  
`<entry key="sysDescriptions">`  
`<value>`  
`<Map>`  
`<entry key="en_US"/>`  
`</Map>`  
`</value>`  
`</entry>`  
`</Map>`  
`</Attributes>`  
`<Inheritance>`  
`<Reference class="sailpoint.object.Bundle" id="0a05661f90131fa481901770e6e30622" name="Roles"/>`  
`</Inheritance>`  
`<Owner>`  
`<Reference class="sailpoint.object.Identity" id="8a85e69f5bc47eac015bd99f2f196d23" name="IIQ-SystemAdministrator"/>`  
`</Owner>`  
`<Requirements>`  
`<Reference class="sailpoint.object.Bundle" id="0a05661e904b1b578190982a29d7759e" name="ADSG-gAP-QRG-P-CASB-ZTNA-Streaming-External"/>`  
`</Requirements>`  
`<Selector>`  
`<IdentitySelector>`  
`<MatchExpression and="true">`  
`<MatchTerm name="inactive" type="IdentityAttribute" value="False"/>`  
`<MatchTerm name="jobCode" type="IdentityAttribute" value="US99013"/>`  
`</MatchExpression>`  
`</IdentitySelector>`  
`</Selector>`  
`</Bundle>`

---

<div class="post-metadata">

**Author:** ![mandarsane](https://sea1.discourse-cdn.com/sailpoint/discuss/user_avatar/developer.sailpoint.com/mandarsane/32/35650_2.png) [@mandarsane](https://developer.sailpoint.com/discuss/u/mandarsane)\
**Post date:** [June 16, 2026, 8:14am UTC](https://developer.sailpoint.com/discuss/t/business-role-with-assignment-rule-assigned-back-after-revoke-in-certification/213584/8 "2026-06-16T08:14:42Z")

</div>

Does Identity match assignment criteria configured on Business role?

---

<div class="post-metadata">

**Author:** ![Rana123H](https://avatars.discourse-cdn.com/v4/letter/r/fbc32d/32.png) [@Rana123H](https://developer.sailpoint.com/discuss/u/Rana123H)\
**Post date:** [June 16, 2026, 10:00am UTC](https://developer.sailpoint.com/discuss/t/business-role-with-assignment-rule-assigned-back-after-revoke-in-certification/213584/9 "2026-06-16T10:00:23Z")

</div>

yes, its matched with assignment criteria

---

<div class="post-metadata">

**Author:** ![mandarsane](https://sea1.discourse-cdn.com/sailpoint/discuss/user_avatar/developer.sailpoint.com/mandarsane/32/35650_2.png) [@mandarsane](https://developer.sailpoint.com/discuss/u/mandarsane)\
**Post date:** [June 16, 2026, 10:31am UTC](https://developer.sailpoint.com/discuss/t/business-role-with-assignment-rule-assigned-back-after-revoke-in-certification/213584/10 "2026-06-16T10:31:39Z")

</div>

If Business role is assigned by Assignment criteria/rule and if we remove it by LCM access request, it does not come back on Identity because of negative assignment. Which means Removal of role by LCM request has higher priority than assignment criteria of business role. I am not sure what happens in case of role removal due to Certifications. Let me replicate this in my IIQ environment

---

<div class="post-metadata">

**Author:** ![neel193](https://sea1.discourse-cdn.com/sailpoint/discuss/user_avatar/developer.sailpoint.com/neel193/32/34038_2.png) [@neel193](https://developer.sailpoint.com/discuss/u/neel193)\
**Post date:** [June 17, 2026, 3:18pm UTC](https://developer.sailpoint.com/discuss/t/business-role-with-assignment-rule-assigned-back-after-revoke-in-certification/213584/11 "2026-06-17T15:18:17Z")

</div>

@Rana123H Did you get a chance to review the identity xml before revoke vs after revoke? That’ll help us troubleshoot better.

---

<div class="post-metadata">

**Author:** ![r\_pragati](https://avatars.discourse-cdn.com/v4/letter/r/41988e/32.png) [@r\_pragati](https://developer.sailpoint.com/discuss/u/r_pragati)\
**Post date:** [June 18, 2026, 4:48am UTC](https://developer.sailpoint.com/discuss/t/business-role-with-assignment-rule-assigned-back-after-revoke-in-certification/213584/12 "2026-06-18T04:48:14Z")

</div>

If the identity selector criteria match, the role will be reassigned automatically. This is expected behavior. You should not certify access for these roles. Instead, configure a **“Role Composition Certification”** to periodically review the role assignment criteria and adjust it if needed.

For the current scenario, if only a handful of users are affected and you need to prevent the role from being assigned, you can add a **`negative=true`** flag to the role assignment in the identity XML.

```auto
  <AssignedRoles>
    <Reference class="sailpoint.object.Bundle" id="0a4111e586ff1dac818732d02e4b1498" name="XYX" nagative="true"/>
  </AssignedRoles>

```

---

<div class="post-metadata">

**Author:** ![sukarande](https://avatars.discourse-cdn.com/v4/letter/s/8edcca/32.png) [@sukarande](https://developer.sailpoint.com/discuss/u/sukarande)\
**Post date:** [June 18, 2026, 5:00am UTC](https://developer.sailpoint.com/discuss/t/business-role-with-assignment-rule-assigned-back-after-revoke-in-certification/213584/13 "2026-06-18T05:00:32Z")

</div>

@Rana123H

This is done by the logic in identity refresh to specifically ignore the role assignment with negative=“true”

Please check once below communication.

> [@Looking for an option in IIQ to revoke business roles during certification which has Assignment logic and that should not assign back to user after Refresh Task?](https://developer.sailpoint.com/discuss/t/looking-for-an-option-in-iiq-to-revoke-business-roles-during-certification-which-has-assignment-logic-and-that-should-not-assign-back-to-user-after-refresh-task/53581):
>
> Which IIQ version are you inquiring about? Version 8.4 Share all details related to your problem, including any error messages you may have received. Background : I have few business roles with assignment logic that can assign to the user dynamically when refresh task executes for the user. I am scheduling a targeted role certification, where reviewer can revoke the business roles for an user. ASK: Looking for an option in IIQ, on business roles revocation during certification which has Ass…

---

<div class="post-metadata">

**Author:** ![neel193](https://sea1.discourse-cdn.com/sailpoint/discuss/user_avatar/developer.sailpoint.com/neel193/32/34038_2.png) [@neel193](https://developer.sailpoint.com/discuss/u/neel193)\
**Post date:** [June 18, 2026, 6:06am UTC](https://developer.sailpoint.com/discuss/t/business-role-with-assignment-rule-assigned-back-after-revoke-in-certification/213584/14 "2026-06-18T06:06:52Z")

</div>

Role Composition review the entitlements. I don’t think it review the assignment logic.

---

<div class="post-metadata">

**Author:** ![Rana123H](https://avatars.discourse-cdn.com/v4/letter/r/fbc32d/32.png) [@Rana123H](https://developer.sailpoint.com/discuss/u/Rana123H)\
**Post date:** [June 18, 2026, 8:00am UTC](https://developer.sailpoint.com/discuss/t/business-role-with-assignment-rule-assigned-back-after-revoke-in-certification/213584/15 "2026-06-18T08:00:35Z")

</div>

yes @neel193 , i had checked. negative= true set after revocation.

---

<div class="post-metadata">

**Author:** ![neel193](https://sea1.discourse-cdn.com/sailpoint/discuss/user_avatar/developer.sailpoint.com/neel193/32/34038_2.png) [@neel193](https://developer.sailpoint.com/discuss/u/neel193)\
**Post date:** [June 18, 2026, 8:54am UTC](https://developer.sailpoint.com/discuss/t/business-role-with-assignment-rule-assigned-back-after-revoke-in-certification/213584/16 "2026-06-18T08:54:05Z")

</div>

@Rana123H purpose of negative=true is to block the automatic reassignment. So, when it assign back, flag remains or it get removed? could you please share the xmls here for review.

---

<div class="post-metadata">

**Author:** ![Rana123H](https://avatars.discourse-cdn.com/v4/letter/r/fbc32d/32.png) [@Rana123H](https://developer.sailpoint.com/discuss/u/Rana123H)\
**Post date:** [June 18, 2026, 2:29pm UTC](https://developer.sailpoint.com/discuss/t/business-role-with-assignment-rule-assigned-back-after-revoke-in-certification/213584/17 "2026-06-18T14:29:58Z")

</div>

![image (2)](https://global.discourse-cdn.com/sailpoint/original/3X/1/a/1a6e0fe4d669e08c496b179f93038041d98ab70a.png)

Hi @neel193 , please find the attached.  
Flag get removed when it assign back.

---

<div class="post-metadata">

**Author:** ![neel193](https://sea1.discourse-cdn.com/sailpoint/discuss/user_avatar/developer.sailpoint.com/neel193/32/34038_2.png) [@neel193](https://developer.sailpoint.com/discuss/u/neel193)\
**Post date:** [June 19, 2026, 7:21am UTC](https://developer.sailpoint.com/discuss/t/business-role-with-assignment-rule-assigned-back-after-revoke-in-certification/213584/18 "2026-06-19T07:21:42Z")

</div>

@Rana123H LEt me try to recreate the scenario in my sandbox. Please confirm if these are the steps:

1. configure a role with assignment logic
2. assign it to a user
3. launch certification on the above configured role , that should include the user
4. revoke the access, that should remove role and set negative=true
5. refresh the user with options: Refresh assigned, detected roles and promote additional entitlements, Provision assignments
6. this should assign the role and remove the negative=true.

---

<div class="post-metadata">

**Author:** ![Rana123H](https://avatars.discourse-cdn.com/v4/letter/r/fbc32d/32.png) [@Rana123H](https://developer.sailpoint.com/discuss/u/Rana123H)\
**Post date:** [June 20, 2026, 3:18pm UTC](https://developer.sailpoint.com/discuss/t/business-role-with-assignment-rule-assigned-back-after-revoke-in-certification/213584/20 "2026-06-20T15:18:25Z")

</div>

I had tested in QA environment and revoke the business role; it was revoked and also IT role and associated entitlement also revoke.  
I have captured the identity xml before and after revoke, as already discussed i can see negative=true set after the revoke on identity profile.  
I revoke I ran certification maintenance and role refresh task again, now role are not getting assign back even role has assignment rule.

can someone confirm negative=true prevent the assignment again if role is revoked as part of certification?

In which cases negative=true will not work when revoke happen?

Thanks in Advance

Harsh

---

<div class="post-metadata">

**Author:** ![Rana123H](https://avatars.discourse-cdn.com/v4/letter/r/fbc32d/32.png) [@Rana123H](https://developer.sailpoint.com/discuss/u/Rana123H)\
**Post date:** [June 22, 2026, 9:04am UTC](https://developer.sailpoint.com/discuss/t/business-role-with-assignment-rule-assigned-back-after-revoke-in-certification/213584/21 "2026-06-22T09:04:09Z")

</div>

Hi @neel193 ,  
That’s correct steps.

[Next page](https://developer.sailpoint.com/discuss/t/business-role-with-assignment-rule-assigned-back-after-revoke-in-certification/213584.md?page=2)