Hi In 8.4 p3, is there a way we can restrict requesting an entitlement before a user has a role in the same application The role currently we are using is IT role. Thanks

@guptaMani You can write a REquestObjectSelector rule in the quicklink population to restrict what entitlements you want to show in the request page based on any assigned/detected role.

@neel193 Can you give some example I am trying to write the rule but not sure how to fetch the entitlement the requestor selected but not sure how to get that value Thanks

You mean the identity (requestee) should not be able to request the entitlement unless they already hold a specific role. To do this, you need to write a custom rule of type RequestObjectSelector and attach it to the relevant Quicklink Population: gear icon → Global Settings → Quicklink Populations → [select population] → Configuration tab → "What can members request?" → Entitlements → Edit Rule → New Rule I’ve attached the code below. Give it a try. import sailpoint.object.Bundle; import sailpoint.object.Filter; import sailpoint.object.Identity; import sailpoint.object.QueryInfo; import java.util.List; String TARGET_ROLE = "IT Access"; String TARGET_APP = "XYZ"; // Returns true if the identity holds roleName as an ASSIGNED or a DETECTED role. boolean hasRole(Identity id, String roleName) { if (id == null) return false; List assigned = id.getAssignedRoles(); if (assigned != null) { for (int i = 0; i < assigned.size(); i++) { Bundle b = (Bundle) assigned.get(i); if (b != null && roleName.equals(b.getName())) return true; } } List detected = id.getBundles(); if (detected != null) { for (int i = 0; i < detected.size(); i++) { Bundle b = (Bundle) detected.get(i); if (b != null && roleName.equals(b.getName())) return true; } } return false; } // Filter that keeps everything EXCEPT TARGET_APP's entitlements. Filter excludeApp = Filter.not(Filter.eq("application.name", TARGET_APP)); if (requestee == null) { return new QueryInfo(null, false); } if (hasRole(requestee, TARGET_ROLE)) { return new QueryInfo(null, false); } else { return new QueryInfo(excludeApp, false); }

Hi @guptaMani I would suggest you write an advanced policy, it will restrict or SOD policy. It is simple. Instead of the RequestObjectSelector, since this will call each and every request, it would cause slowness, as per the performance. Thanks, PVR.

@Peddapolu I think the requirement is to not be able to request the entitlement in the first place, but from my understanding, an Advanced/SoD Policy is evaluated after the user has selected and submitted the entitlement request. So the entitlement is still visible and requestable and the policy catches it as a violation afterward. As for performance, we’re just evaluating the roles assigned to the current identity, so it loops over the number of roles on that identity rather than the size of the entitlement catalog.

Hi @bohorapujan I got your point. Even though there are still issues with fat identities, we face similar issues. That is why I would recommend addressing this case through the policy violation since you handle the user and prevent access. That should be fine from a compliance perspective. How many entitlements and roles are dependent on each other?

Hello Manisha. I would go with @bohorapujan approach here. Policies are evaluated after the request is submitted, so the entitlement is still requestable. A RequestObjectSelector can filter the entitlements available to request based on whether the user already has the required IT role, which lines up with what you’re trying to prevent. If the role/app mappings are likely to grow, you could keep them in a Custom object and read them from the rule. That way you don’t need to change the rule every time a new mapping is added.

Request Object Selector rule with Quicklink Population can be used to restrict entitlements from being requested.

Thanks for sharing the rule I have one issue, I cannot hard code the application name or the role name The application can be among 15 + apps which start with the same prefix, for example "ABC Application - " I need the rule to be more generic to be considered for any apps starting with "ABC Application - " I can get all the roles for that app but how do I get that application from that list is a challenge Thanks

@guptaMani You can store the application names and roles in the custom object and read the custom object in the rule. Rule could be generic and config can be stored in the custom object.

Is it possible to restrict requesting an entitlement before a user has a role in the application

IdentityIQ (IIQ) IIQ Discussion and Questions

neel193 (Neelmadhav Panda) August 24, 2026, 10:21am 19

@guptaMani In case it is still open, please check this post: Advanced Policy Violation Rule - IdentityIQ (IIQ) / IIQ Community Knowledge Base - SailPoint Developer Community

Here is a sample rule with other description.

Topic		Replies	Views
How should i get the users selected entitlement in policies? IIQ Discussion and Questions rules , identityiq , entitlements	8	1000	August 14, 2023
How to fliter entitlements in mange user access page based on the application selection IIQ Discussion and Questions identityiq	6	1159	June 2, 2023
Creating a way for a manager to only request specific entitlements and roles IIQ Discussion and Questions identityiq , entitlements	20	1733	August 5, 2023
How should i get the users selected entitlement in advanced policies? IIQ Discussion and Questions identityiq	5	1355	September 21, 2023
Quicklink Population: Filtering what a user can select to remove IIQ Discussion and Questions rules , identityiq , access-requests , entitlements	6	673	July 9, 2024

Is it possible to restrict requesting an entitlement before a user has a role in the application

Related topics