# Limit entitlements selection in Access Request

**URL:** <https://developer.sailpoint.com/discuss/t/limit-entitlements-selection-in-access-request/99242>\
**Category:** IIQ Discussion and Questions\
**Tags:** access-requests, identityiq\
**Created:** [January 28, 2025, 2:32pm UTC](https://developer.sailpoint.com/discuss/t/limit-entitlements-selection-in-access-request/99242 "2025-01-28T14:32:00Z")\
**Posts on this page:** 11\
**Page:** 1

<div class="post-metadata">

**Author:** ![gargshub5](https://avatars.discourse-cdn.com/v4/letter/g/f14d63/32.png) [@gargshub5](https://developer.sailpoint.com/discuss/u/gargshub5)\
**Post date:** [January 28, 2025, 2:32pm UTC](https://developer.sailpoint.com/discuss/t/limit-entitlements-selection-in-access-request/99242/1 "2025-01-28T14:32:00Z")

</div>

IIQ 8.3

HI team,

Is there a way to limit the number of items an end user can request on the Manage User access basically in the access request.

In my case if more than 25 entitlements are being requested they are getting failed hence I want to limit the entitlement selection to 20 or so

Thanks

---

<div class="post-metadata">

**Author:** ![aditprad003](https://avatars.discourse-cdn.com/v4/letter/a/3bc359/32.png) [@aditprad003](https://developer.sailpoint.com/discuss/u/aditprad003)\
**Post date:** [January 29, 2025, 12:33pm UTC](https://developer.sailpoint.com/discuss/t/limit-entitlements-selection-in-access-request/99242/2 "2025-01-29T12:33:31Z")

</div>

we are limiting no. of entitlements by customizing OOTB LCM workflow. You can add a step , this step will read the plan and if plan has more than 20 adds , you can prompt an error to the user. however, user will need to submit request again with less no of entitlements. Apart from this I don’t think there is a way to limit the no. of adds in the access request.

---

<div class="post-metadata">

**Author:** ![daniel\_neubert](https://sea1.discourse-cdn.com/sailpoint/discuss/user_avatar/developer.sailpoint.com/daniel_neubert/32/714_2.png) [@daniel\_neubert](https://developer.sailpoint.com/discuss/u/daniel_neubert)\
**Post date:** [January 29, 2025, 1:32pm UTC](https://developer.sailpoint.com/discuss/t/limit-entitlements-selection-in-access-request/99242/3 "2025-01-29T13:32:50Z")

</div>

Hi @gargshub5 ,

you will be able to achieve the goal by using a policy and enable Policy checking in the LCM workflow used for the Access Request.

Best regards,  
Daniel

---

<div class="post-metadata">

**Author:** ![Venu1010](https://avatars.discourse-cdn.com/v4/letter/v/dec6dc/32.png) [@Venu1010](https://developer.sailpoint.com/discuss/u/Venu1010)\
**Post date:** [March 13, 2025, 4:10am UTC](https://developer.sailpoint.com/discuss/t/limit-entitlements-selection-in-access-request/99242/4 "2025-03-13T04:10:19Z")

</div>

any idea about this?

---

<div class="post-metadata">

**Author:** ![aditprad003](https://avatars.discourse-cdn.com/v4/letter/a/3bc359/32.png) [@aditprad003](https://developer.sailpoint.com/discuss/u/aditprad003)\
**Post date:** [March 20, 2025, 6:59am UTC](https://developer.sailpoint.com/discuss/t/limit-entitlements-selection-in-access-request/99242/5 "2025-03-20T06:59:38Z")

</div>

You can modify LCM workflow. Add a new step before step initialize step in LCM. in this new step read the plan. now you can check how many “add” are there in the plan. if your condition meets then move to error step else continue. in the error step you can display why this request cannot be submitted as user requested more than 20 entitlements.  
for eg.

```auto
<Step icon="Start" name="Start" posX="25" posY="10">
    <Transition to="CUSTOM_STEP"/>
  </Step>

```

now you can create your own libraries and pass the plan, where you can calculate adds etc etc.

```auto
<Step action="script:getAccessRequestErrorMessage(identityName, plan)" name=CUSTOM_STEP" posX="25" posY="10" resultVariable="accessRequestErrorMessage">
    <Transition to="Exit With Error" when="script:null!=accessRequestErrorMessage"/>
    <Transition to="initialise"/>
  </Step>

```

---

<div class="post-metadata">

**Author:** ![daniel\_neubert](https://sea1.discourse-cdn.com/sailpoint/discuss/user_avatar/developer.sailpoint.com/daniel_neubert/32/714_2.png) [@daniel\_neubert](https://developer.sailpoint.com/discuss/u/daniel_neubert)\
**Post date:** [March 20, 2025, 10:14am UTC](https://developer.sailpoint.com/discuss/t/limit-entitlements-selection-in-access-request/99242/6 "2025-03-20T10:14:56Z")

</div>

This would definitely work.  
However please take into consideration that there was already effort for the requester to sample together the request.  
If now the request just fails the user experience may be negatively impacted.

That’s the reason why we use Policies to achieve the goal and that works really well.

Kind regards,  
Daniel

---

<div class="post-metadata">

**Author:** ![aditprad003](https://avatars.discourse-cdn.com/v4/letter/a/3bc359/32.png) [@aditprad003](https://developer.sailpoint.com/discuss/u/aditprad003)\
**Post date:** [March 25, 2025, 10:21am UTC](https://developer.sailpoint.com/discuss/t/limit-entitlements-selection-in-access-request/99242/7 "2025-03-25T10:21:36Z")

</div>

HI @daniel_neubert please shed some light on how we can use policies for limiting the no. of entitlements during access request.

---

<div class="post-metadata">

**Author:** ![vishal\_kejriwal1](https://sea1.discourse-cdn.com/sailpoint/discuss/user_avatar/developer.sailpoint.com/vishal_kejriwal1/32/10904_2.png) [@vishal\_kejriwal1](https://developer.sailpoint.com/discuss/u/vishal_kejriwal1)\
**Post date:** [March 25, 2025, 1:48pm UTC](https://developer.sailpoint.com/discuss/t/limit-entitlements-selection-in-access-request/99242/8 "2025-03-25T13:48:11Z")

</div>

No OOTB option .

I would recommended try using custom plugin . Workflow modification won’t be a great approach as that will trigger after submission of request .

---

<div class="post-metadata">

**Author:** ![daniel\_neubert](https://sea1.discourse-cdn.com/sailpoint/discuss/user_avatar/developer.sailpoint.com/daniel_neubert/32/714_2.png) [@daniel\_neubert](https://developer.sailpoint.com/discuss/u/daniel_neubert)\
**Post date:** [March 25, 2025, 6:43pm UTC](https://developer.sailpoint.com/discuss/t/limit-entitlements-selection-in-access-request/99242/9 "2025-03-25T18:43:02Z")

</div>

Hi @aditprad003 ,

basically the idea is to compare the persisted identity with the version passed into the policy check (policy rule).  
If you compare the values  
identity.getAssignedRoles().size()  
with the persisted identity you should be able to retrieve the number of roles requested.  
Based on the comparison you may want to create a Policy Violation.

Unfortunately I do not have access to the environment where we already made some tests but please have a look into the following post on Compass:

[Solved: Advanced Policy: Extracting Requested Roles/Entitles When Submitting Requests Through Manage Access - Page 2 - Compass](https://community.sailpoint.com/t5/IdentityIQ-Forum/Advanced-Policy-Extracting-Requested-Roles-Entitles-When/td-p/162745/page/2)

You’ll also find some example code there.

Best regards,  
Daniel

---

<div class="post-metadata">

**Author:** ![Muhammad\_Mustafa](https://sea1.discourse-cdn.com/sailpoint/discuss/user_avatar/developer.sailpoint.com/muhammad_mustafa/32/27611_2.png) [@Muhammad\_Mustafa](https://developer.sailpoint.com/discuss/u/Muhammad_Mustafa)\
**Post date:** [March 26, 2025, 10:30pm UTC](https://developer.sailpoint.com/discuss/t/limit-entitlements-selection-in-access-request/99242/10 "2025-03-26T22:30:57Z")

</div>

Hi @daniel_neubert, this is a great idea, thank you for referring to the topic and sharing it :).  
and thanks to @robertpatterson for the code…

---

<div class="post-metadata">

**Author:** ![system](https://global.discourse-cdn.com/sailpoint/original/2X/f/f2136700ed5e3703e0b85e02f6be799dacca7735.png) [@system](https://developer.sailpoint.com/discuss/u/system)\
**Post date:** [May 25, 2025, 10:31pm UTC](https://developer.sailpoint.com/discuss/t/limit-entitlements-selection-in-access-request/99242/11 "2025-05-25T22:31:06Z")

</div>

This topic was automatically closed 60 days after the last reply. New replies are no longer allowed.