# IIQ Roles Duplicated

**URL:** <https://developer.sailpoint.com/discuss/t/iiq-roles-duplicated/11245>\
**Category:** IIQ Discussion and Questions\
**Tags:** roles, identityiq\
**Created:** [May 16, 2023, 3:24pm UTC](https://developer.sailpoint.com/discuss/t/iiq-roles-duplicated/11245 "2023-05-16T15:24:20Z")\
**Posts on this page:** 10\
**Page:** 1

<div class="post-metadata">

**Author:** ![177963](https://avatars.discourse-cdn.com/v4/letter/1/dec6dc/32.png) [@177963](https://developer.sailpoint.com/discuss/u/177963)\
**Post date:** [May 16, 2023, 3:24pm UTC](https://developer.sailpoint.com/discuss/t/iiq-roles-duplicated/11245/1 "2023-05-16T15:24:20Z")

</div>

Hello Experts,

I see a weird behavior that roles are being assigned 2 times with different assignment ids, any idea why IIQ would create two assignment for same role? mostly role propagation and birthright role assignments are in this category.

 ![image](https://global.discourse-cdn.com/sailpoint/original/2X/c/c417c669a7f6c864b64a469628d6841a16a5e945.png)

This is also causing dependency conflict during removal and roles are tagged as retain=“true”.

Please advise.

Thanks

---

<div class="post-metadata">

**Author:** ![ajmerasunny1](https://avatars.discourse-cdn.com/v4/letter/a/3be4f8/32.png) [@ajmerasunny1](https://developer.sailpoint.com/discuss/u/ajmerasunny1)\
**Post date:** [May 16, 2023, 4:49pm UTC](https://developer.sailpoint.com/discuss/t/iiq-roles-duplicated/11245/2 "2023-05-16T16:49:51Z")

</div>

Do you have “Allow multiple assignment for all assignable roles” setting enabled?

---

<div class="post-metadata">

**Author:** ![177963](https://avatars.discourse-cdn.com/v4/letter/1/dec6dc/32.png) [@177963](https://developer.sailpoint.com/discuss/u/177963)\
**Post date:** [May 16, 2023, 5:05pm UTC](https://developer.sailpoint.com/discuss/t/iiq-roles-duplicated/11245/3 "2023-05-16T17:05:01Z")

</div>

thanks Sunny. no its not enabled , only propagation is enabled under Roles tab.

---

<div class="post-metadata">

**Author:** ![brian\_weigel](https://sea1.discourse-cdn.com/sailpoint/discuss/user_avatar/developer.sailpoint.com/brian_weigel/32/2194_2.png) [@brian\_weigel](https://developer.sailpoint.com/discuss/u/brian_weigel)\
**Post date:** [May 16, 2023, 11:05pm UTC](https://developer.sailpoint.com/discuss/t/iiq-roles-duplicated/11245/4 "2023-05-16T23:05:42Z")

</div>

This looks like it’s coming from a ProvisioningPlan. Have you checked to see what’s shown on the Identity itself, as well as checked to see if that issue is still present on the Identity after it’s refreshed with `Refresh assigned and detected roles` enabled?

As a side-note, I’m a bit old-school in that I tend to shy away from the role synchronization/propogation task and instead rely on my periodic Identity Refresh tasks to handle provisioning of any changes to assigned roles. In my experience, that’s always been pretty consistent (especially since it’s a far older process, so more time to find and fix bugs).

I generally have at least 1 of those per day that cover all identities (or at the very least all active, correlated identities).

---

<div class="post-metadata">

**Author:** ![177963](https://avatars.discourse-cdn.com/v4/letter/1/dec6dc/32.png) [@177963](https://developer.sailpoint.com/discuss/u/177963)\
**Post date:** [May 17, 2023, 1:48pm UTC](https://developer.sailpoint.com/discuss/t/iiq-roles-duplicated/11245/5 "2023-05-17T13:48:34Z")

</div>

thanks Brian, its coming from the provisioning plan as the role propagation task in OOTB, but why it is duplicating is the question.

Thanks for sharing your experience but here we use the role propagation task. There are lot of custom created role types we use.

---

<div class="post-metadata">

**Author:** ![brian\_weigel](https://sea1.discourse-cdn.com/sailpoint/discuss/user_avatar/developer.sailpoint.com/brian_weigel/32/2194_2.png) [@brian\_weigel](https://developer.sailpoint.com/discuss/u/brian_weigel)\
**Post date:** [May 17, 2023, 2:44pm UTC](https://developer.sailpoint.com/discuss/t/iiq-roles-duplicated/11245/6 "2023-05-17T14:44:02Z")

</div>

Since the Role Change Propagation task (and process) is an OOB feature, I’d suggest gathering some additional log info (along with steps to reproduce the issue if possible) and open a Support case to get some extra eyes on it.

---

<div class="post-metadata">

**Author:** ![nagendrak1](https://avatars.discourse-cdn.com/v4/letter/n/958977/32.png) [@nagendrak1](https://developer.sailpoint.com/discuss/u/nagendrak1)\
**Post date:** [May 17, 2023, 3:45pm UTC](https://developer.sailpoint.com/discuss/t/iiq-roles-duplicated/11245/7 "2023-05-17T15:45:11Z")

</div>

Does the user have multiple accounts in the same app to which the entitlements in Role belong to?

---

<div class="post-metadata">

**Author:** ![177963](https://avatars.discourse-cdn.com/v4/letter/1/dec6dc/32.png) [@177963](https://developer.sailpoint.com/discuss/u/177963)\
**Post date:** [May 17, 2023, 4:13pm UTC](https://developer.sailpoint.com/discuss/t/iiq-roles-duplicated/11245/8 "2023-05-17T16:13:07Z")

</div>

yeah, will do that. Thanks a lot for your input.

---

<div class="post-metadata">

**Author:** ![177963](https://avatars.discourse-cdn.com/v4/letter/1/dec6dc/32.png) [@177963](https://developer.sailpoint.com/discuss/u/177963)\
**Post date:** [May 17, 2023, 4:14pm UTC](https://developer.sailpoint.com/discuss/t/iiq-roles-duplicated/11245/9 "2023-05-17T16:14:22Z")

</div>

Hi Nagendra, no the user has single account.

---

<div class="post-metadata">

**Author:** ![system](https://global.discourse-cdn.com/sailpoint/original/2X/f/f2136700ed5e3703e0b85e02f6be799dacca7735.png) [@system](https://developer.sailpoint.com/discuss/u/system)\
**Post date:** [July 19, 2023, 2:26pm UTC](https://developer.sailpoint.com/discuss/t/iiq-roles-duplicated/11245/10 "2023-07-19T14:26:07Z")

</div>


