# Entitlement SOD, allow only one entitlement from an application **URL:** \ **Category:** IIQ Discussion and Questions\ **Created:** [March 30, 2022, 5:56am UTC](https://developer.sailpoint.com/discuss/t/entitlement-sod-allow-only-one-entitlement-from-an-application/3596 "2022-03-30T05:56:55Z")\ **Posts on this page:** 10\ **Page:** 1
**Author:** ![ssel](https://avatars.discourse-cdn.com/v4/letter/s/96bed5/32.png) [@ssel](https://developer.sailpoint.com/discuss/u/ssel)\ **Post date:** [March 30, 2022, 5:56am UTC](https://developer.sailpoint.com/discuss/t/entitlement-sod-allow-only-one-entitlement-from-an-application/3596/1 "2022-03-30T05:56:56Z")
Hello, We got around 30 entitlements in an application and we need to allow only one entitlement at any point and time via Access request. What would be the best way to achieve this? ---
**Author:** ![ssiva](https://avatars.discourse-cdn.com/v4/letter/s/dec6dc/32.png) [@ssiva](https://developer.sailpoint.com/discuss/u/ssiva)\ **Post date:** [March 30, 2022, 4:11pm UTC](https://developer.sailpoint.com/discuss/t/entitlement-sod-allow-only-one-entitlement-from-an-application/3596/2 "2022-03-30T16:11:05Z")
Team - any inputs? We do have the similar situation…I knew we could create multiple rules such as A → conflict with B,C,D,E… B → conflict with A,C,D,E… C → conflict with A,B,D,E… and go on But is this the only way? Again all the entitlements are part of the same application in our usecase. Any insight would be appreciated, Thanks! ---
**Author:** ![adam\_creaney](https://sea1.discourse-cdn.com/sailpoint/discuss/user_avatar/developer.sailpoint.com/adam_creaney/32/8971_2.png) [@adam\_creaney](https://developer.sailpoint.com/discuss/u/adam_creaney)\ **Post date:** [March 31, 2022, 4:31pm UTC](https://developer.sailpoint.com/discuss/t/entitlement-sod-allow-only-one-entitlement-from-an-application/3596/3 "2022-03-31T16:31:01Z")
Have you had an opportunity to review the documentation around advanced policies and IdentitySelectors: [Advanced Policies](https://community.sailpoint.com/t5/IdentityIQ-Wiki/Policies/ta-p/79011#toc-hId-325130636) [IdentitySelectors](https://community.sailpoint.com/t5/IdentityIQ-Wiki/IdentitySelectors-in-the-IdentityIQ-User-Interface/ta-p/79597) I wonder if they could be used here. ---
**Author:** ![paulo\_urcid](https://avatars.discourse-cdn.com/v4/letter/p/848f3c/32.png) [@paulo\_urcid](https://developer.sailpoint.com/discuss/u/paulo_urcid)\ **Post date:** [March 31, 2022, 5:02pm UTC](https://developer.sailpoint.com/discuss/t/entitlement-sod-allow-only-one-entitlement-from-an-application/3596/4 "2022-03-31T17:02:18Z")
I don’t think it is practical or scalable to have to create an SoD Policy with every combination of entitlements. You can always modify the Access Request Worklfow and add a step which validates if the user already has an entitlement on the application, and if they do, then the Workflow terminates with an error saying something like “You must first remove your current entitlement before requesting a new one…” ---
**Author:** ![menno\_pieters](https://sea1.discourse-cdn.com/sailpoint/discuss/user_avatar/developer.sailpoint.com/menno_pieters/32/66_2.png) [@menno\_pieters](https://developer.sailpoint.com/discuss/u/menno_pieters)\ **Post date:** [March 31, 2022, 6:23pm UTC](https://developer.sailpoint.com/discuss/t/entitlement-sod-allow-only-one-entitlement-from-an-application/3596/5 "2022-03-31T18:23:08Z")
I agree with @paulo_urcid. Alternatively, a Before Provisioning Rule can be used to inspect the provisioning - if an entitlement is being added, make it replace whatever the user has; if multiple entitlements are being added, throw an exception and make it fail. Or always make it fail if the result of the provisioning action would be multiple entitlements. ---
**Author:** ![ssiva](https://avatars.discourse-cdn.com/v4/letter/s/dec6dc/32.png) [@ssiva](https://developer.sailpoint.com/discuss/u/ssiva)\ **Post date:** [March 31, 2022, 7:39pm UTC](https://developer.sailpoint.com/discuss/t/entitlement-sod-allow-only-one-entitlement-from-an-application/3596/6 "2022-03-31T19:39:30Z")
Thanks @paulo_urcid/@menno_pieters. It makes sense. BTW, have any sample code handy to perform this. ---
**Author:** ![menno\_pieters](https://sea1.discourse-cdn.com/sailpoint/discuss/user_avatar/developer.sailpoint.com/menno_pieters/32/66_2.png) [@menno\_pieters](https://developer.sailpoint.com/discuss/u/menno_pieters)\ **Post date:** [April 2, 2022, 8:31am UTC](https://developer.sailpoint.com/discuss/t/entitlement-sod-allow-only-one-entitlement-from-an-application/3596/7 "2022-04-02T08:31:20Z")
The Rule Guide on Compass explains how the rule works, inputs/outputs and has some example code: [https://community.sailpoint.com/t5/Technical-White-Papers/Rules-in-IdentityIQ-7-0-7-2/ta-p/78176](https://community.sailpoint.com/t5/Technical-White-Papers/Rules-in-IdentityIQ-7-0-7-2/ta-p/78176). ---
**Author:** ![HTawney](https://avatars.discourse-cdn.com/v4/letter/h/fbc32d/32.png) [@HTawney](https://developer.sailpoint.com/discuss/u/HTawney)\ **Post date:** [February 22, 2023, 12:06pm UTC](https://developer.sailpoint.com/discuss/t/entitlement-sod-allow-only-one-entitlement-from-an-application/3596/8 "2023-02-22T12:06:37Z")
I am urgently looking for SailPoint Developer! We need a contractor with a strong understanding of SailPoint IIQ product components, its architecture, and interfaces. Does this sound like the role for you? Get in touch! Duration: 12 Months + Location: UK Harry Tawney 07467 617 739 - Call Or Text [harry.tawney@macleanmoore.com](mailto:harry.tawney@macleanmoore.com) ---
**Author:** ![mikechung](https://sea1.discourse-cdn.com/sailpoint/discuss/user_avatar/developer.sailpoint.com/mikechung/32/36607_2.png) [@mikechung](https://developer.sailpoint.com/discuss/u/mikechung)\ **Post date:** [February 22, 2023, 9:45pm UTC](https://developer.sailpoint.com/discuss/t/entitlement-sod-allow-only-one-entitlement-from-an-application/3596/9 "2023-02-22T21:45:19Z")
> [@ssel](#): > > Hello, We got around 30 entitlements in an application and we need to allow only one entitlement at any point and time via Access request. What would be the best way to achieve this? Hello, Can you be more clear regarding the requirement, do you mean (1) we only want only one entitlement per that application can be assigned or (2) simply user can request only one entitlement of that application per each Access Request? If you mean the first scenario, then I believe writing a Policy Executor is the way to go. if you want to achieve second scenario, we have a plugin solution which can solve your requirement elegantly: [https://community.sailpoint.com/t5/Plugin-Framework/KOGIT-Access-Request-Extension/ta-p/228216](https://community.sailpoint.com/t5/Plugin-Framework/KOGIT-Access-Request-Extension/ta-p/228216) Thanks and Regards, Mike ---
**Author:** ![system](https://global.discourse-cdn.com/sailpoint/original/2X/f/f2136700ed5e3703e0b85e02f6be799dacca7735.png) [@system](https://developer.sailpoint.com/discuss/u/system)\ **Post date:** [July 19, 2023, 2:25pm UTC](https://developer.sailpoint.com/discuss/t/entitlement-sod-allow-only-one-entitlement-from-an-application/3596/10 "2023-07-19T14:25:33Z")