Hello Tiago. Manish (@kumarSinghM) is pointing at the right area. I would also check the revocation timing.
The message “Item is revoked but has not been removed” does not necessarily mean provisioning failed. It can mean the revocation was requested, but IIQ has not yet confirmed that the access is actually gone from the account.
When the revocation is sent depends on Process Revokes Immediately. If enabled, it is processed when the Revoke decision is saved. If disabled, it is normally sent when the certification is signed off. An active challenge period can delay it further. (docs)
After that, Scan for completed revocations checks whether the access was actually removed. By default, IIQ scans a certification’s revocations once per day. (docs)
So with Revocation Period Duration = 1 day, there may be very little time for the remediation and completion check to finish before the revocation period ends, especially for disconnected applications where the work item must be completed and the account aggregated back into IIQ. I would test with a longer revocation period.
The Time After Certification Expiration = 1 hour setting is different. It controls when automatic closing occurs and how undecided items are handled. It is not a provisioning timeout. (docs)
I would check whether the access was actually removed on the target and whether Scan for completed revocations is enabled and running. If the access is already gone but IIQ still shows the message, the issue is more likely with aggregation or close-loop verification than provisioning itself.