This use case can be handled using 3 steps:
- Use Identity profile config to auto remove entitlements for sources.
- Use before provisioning rule to remove residual entitlements.
- Use this workflow to remove all sticky Roles and other access items by submitting revoke access request. Workflow - Remove Entitlements from selected source - #7 by colin_mckibben