Can there be a threshold check while assignment or removal of role?

“Can there be”…yes. Somewhat of a custom job.

For the roles that you want to ‘protect’ with a threshold, specify a dummy approver.

With a periodic workflow / script, get a list of approved access requests with this particular role assigned in the last, say, 24 hours. If the count is greater than 100, deny the approval request. If the count is less than 100, approve the pending approval request. (Handle the pending approval request in a sorted order)

e.g. Get-V2024AccessRequestStatus with filtering and pipelining, Get-V2024PendingApprovals

Additionally, you can leverage metadata attributes to specify per-role threshold. The powershell script just need to get this metadata attribute’s value of the role instead of having hard-coded 100.