This is possible with a Workflow which has an External Trigger. This Workflow would be called by the “Access Request Submitted” Event Trigger and would check if the identity currently has one of these Access Profiles. If yes, then it submits a request to remove the old AP in order to allow the new one.
See this post on how to configure a Workflow with a request-response type Event Trigger: Implementing A Request Response Type Trigger in Workflows
2 Likes