IIQ 8.3P5. Same issue as this thread that’s now closed: Unable to remove entitlements through Manage Access page if those are part of Roles Essentially, if we have an entitlement assigned via LCM, it doesn’t show up as an option to remove later on if that entitlement also belongs to an IT role (ju…

Hi @cds2 Yes, the behavior you’re describing in IdentityIQ, where an entitlement assigned via LCM cannot be directly removed through the Manage Access page if that entitlement is also being detected as part of an IT role, is generally the intended behavior. Here’s why and the logic behind it: So…

Thanks. In this case, however, the entitlement wasn’t “granted” by an IT role. It was assigned directly as an entitlement in Manage Access (and perhaps the user also has several other entitlements and this particular bundle of entitlements is what makes up an IT role that’s required by some busine…

I understand how sticky entitlements work. I guess I’m lost on how this is the intended design. Let’s say, we have the following: ITRole1 with 2 direct entitlements for 2 AD groups (Group1 and Group2). BusinessRole1 with automatic assignment logic and requires ITRole1. After an identity is term…

Dear @cds2 let me check with my colleagues and Experts whether my understanding is wrong. IT Roles are Derived: IT roles in IdentityIQ are typically assigned based on some criteria (e.g., membership in an AD group, user’s department attribute, etc.). If a user meets the criteria for an IT role, t…

[image] Curran Sullivan: option to remove later on if that entitlement also belongs to an IT role (just being detected…no business role is assigned, just the entitlement). Is this the intended behavior? Yes, what is your requirement? normally we design the role to get assigned based on some …

Hi Kumar I explained the use case in my most recent message.

Removing Entitlement that also belongs to a role

IdentityIQ (IIQ) IIQ Discussion and Questions

pattabhi (Pattabhi Nandarapu) June 3, 2025, 5:09pm 4

Please check below topic about sticky entitlements

Resolving Sticky Entitlements: Common Causes and Solutions - IdentityIQ (IIQ) / IIQ Community Knowledge Base - SailPoint Developer Community

Topic		Replies	Views
Unable to remove entitlements through Manage Access page if those are part of Roles IIQ Discussion and Questions identityiq , roles	7	540	August 13, 2024
IT role and entitlements stay back after the Business role is removed as per the criteria IIQ Discussion and Questions apis , rules , identityiq , provisioning , connectors , entitlements	14	239	March 21, 2026
Role Entitlement Removal ISC Discussion and Questions identity-security-cloud , provisioning , roles , access-profiles , entitlements	15	2573	July 30, 2024
Assign Entitlement Directly and Remove Entitlement from Business Role IIQ Discussion and Questions identityiq , roles , entitlements	7	353	June 27, 2024
Delimited application, remove request for one of the entitlement in the IT Role IIQ Discussion and Questions identityiq , roles	3	608	November 17, 2023

Removing Entitlement that also belongs to a role

Related topics