Hi @venus,
This is due to the Attribute Assignment (Sticky entitlements) in the identity Cube. Attribute Assignments are added to an identity to track entitlements that have been assigned to them, typically from an access request. It can be viewed on the Identity via debug page. Whenever a user is provisioned via Access Request (LCM) this sticky attribute is added to the identity. This will be part of the provisioning plan under attributes as assignment = true. Refreshing the identity will retry provisioning of missing entitlements and accounts. Removing the sticky attribute from Identity cube will fix the issue. The ideal way will be via a remove request instead of direct update of identity cube.
There is a session by @brian_weigel on how to remove these Attribute Assignments. Ungluing Sticky AttributeAssignments