We have an application integrated with ISC that supports only 1 entitlement at a time for a user. If a user requests entitlement E1, ISC provisions E1 and this is fine. But when the same user requests entitlement E2, ISC provisions E2 and then E1 again and then E2 and it keeps on doing that a few ti…

Thanks @ksbagade . I should have tried out using access profiles instead of just assuming! This helps a lot.

In SailPoint Identity Security Cloud this behavior occurs because entitlements are modeled as additive access, so when the application only supports a single entitlement ISC repeatedly tries to remediate the missing previously granted access during identity refresh. The recommended approach is to mo…

A couple of contracts ago, I ran into a problem with deliminated sources where users if users were given two entitlements in the source, ISC used to only hold one of them. This occurred because ‘Entitlements’ was not set as ‘multi-valued’ in the schema [image] Have you tried amending the schema t…

@asaxena I’m glad you were able to resolve your issue :slightly_smiling_face: If my response was helpful, please mark it as the solution for the thread.

Hi @asaxena Can you please confirm what type of application is it ? If it is web service based application, then the issue could be that the API is replacing the entitlements instead of adding it. Or in back-end the assignments are correct ? Thank You. Regards Vikas

Have you tried wrapping the entitlements in Access Profiles instead of making them directly requestable? Since Access Profiles assigned via access requests are not sticky, ISC won’t keep trying to re-provision the old entitlement during identity refresh.

Hi @PhilRawlings1 yes the entitlement attribute is not marked as multi valued and the behaviour is what I have described above.

Managing single valued entitlement

Identity Security Cloud (ISC) ISC Discussion and Questions

ksbagade (Kartik Bagade) April 16, 2026, 10:20am 2

Hi @asaxena

A good solution to your single valued entitlement would be to use Access Profiles for Access Requests.

Access Profiles for Access Requests - As per this post on entitlement stickiness, APs assigned via access requests should not be sticky and will not reassign on the access being deprovisioned.

Hope this helps!

Topic		Replies	Views
Question about single-value entitlement schema behavior in SailPoint ISC ISC Discussion and Questions identity-security-cloud , access-profiles , entitlements	3	85	October 31, 2025
Single value entitlement restriction on end system ISC Discussion and Questions identity-security-cloud , provisioning , access-requests , entitlements	3	58	December 16, 2025
One and only one access profile assign to user at a time ISC Discussion and Questions identity-security-cloud , entitlements	3	82	October 1, 2025
Entitlement SOD, allow only one entitlement from an application IIQ Discussion and Questions	9	1893	July 19, 2023
Webservices Add Entitlement by Requesting keeps on reprovisioning and created Identity refresh activities ISC Discussion and Questions webservice-connector , identity-security-cloud , provisioning , entitlements	5	242	November 12, 2024

Managing single valued entitlement

Related topics