Few questions,
- What is not working in the Workflow?
- Are those entitlements part of any roles or access profiles which can still assigned to the identities and in your scope?
Based on your comment, you can use the Search based certification via API within a workflow to revoke the access which you get from your search results. Keep it in mind that those entitlements still get assigned to the identity if those are part of any roles or identity profiles which already assigned to any of these identities.
Below are few links which may help in your case