I just posted my workflow configuration doing exactly that here! It relies on a targetted micro-certification campaign which we autocomplete and revoke all access, which means it avoids all the trouble you face by doing it with Access Requests.
I just posted my workflow configuration doing exactly that here! It relies on a targetted micro-certification campaign which we autocomplete and revoke all access, which means it avoids all the trouble you face by doing it with Access Requests.