# Right-Sizing entitlement membership after creating a role **URL:** \ **Category:** SHF Discussion and Questions\ **Tags:** roles, entitlements, sailpoint-identity-security\ **Created:** [February 19, 2024, 8:02pm UTC](https://developer.sailpoint.com/discuss/t/right-sizing-entitlement-membership-after-creating-a-role/31180 "2024-02-19T20:02:00Z")\ **Posts on this page:** 7\ **Page:** 1
**Author:** ![RPook](https://avatars.discourse-cdn.com/v4/letter/r/b487fb/32.png) [@RPook](https://developer.sailpoint.com/discuss/u/RPook)\ **Post date:** [February 19, 2024, 8:02pm UTC](https://developer.sailpoint.com/discuss/t/right-sizing-entitlement-membership-after-creating-a-role/31180/1 "2024-02-19T20:02:00Z")
Howdy. Question: Will SailPoint automatically remove users from a pre-populated entitlement? We have just received the new IDN functionality to allow Entitlements to be added directly to Roles (_without the need for an Access Profile_). I have an assumption, but I want to be sure I am correct. Does this logic make sense? Let’s assume that I have an Entitlement (AD Group) with a 6 members. It’s based on Location, but has never been maintained. It consists of users from all over the globe. I build a Role. I configure Access to my Entitlement. I do not touch Access Profiles. Then I Define an Assignment “_IDN Attribute_ ”. Will SailPoint remove users who don’t meet this criteria? ---
**Author:** ![ethompson](https://sea1.discourse-cdn.com/sailpoint/discuss/user_avatar/developer.sailpoint.com/ethompson/32/17298_2.png) [@ethompson](https://developer.sailpoint.com/discuss/u/ethompson)\ **Post date:** [February 19, 2024, 10:50pm UTC](https://developer.sailpoint.com/discuss/t/right-sizing-entitlement-membership-after-creating-a-role/31180/2 "2024-02-19T22:50:30Z")
Creating a role will not remove access from existing users that have those entitlements. Only if the user meets the role criteria and then later no longer meets the criteria will the access be removed. ---
**Author:** ![baoussounda](https://sea1.discourse-cdn.com/sailpoint/discuss/user_avatar/developer.sailpoint.com/baoussounda/32/13095_2.png) [@baoussounda](https://developer.sailpoint.com/discuss/u/baoussounda)\ **Post date:** [February 21, 2024, 7:07am UTC](https://developer.sailpoint.com/discuss/t/right-sizing-entitlement-membership-after-creating-a-role/31180/3 "2024-02-21T07:07:09Z")
> [@RPook](#): > > Role @RPook here Sailpoint recommandation for access remove via role ![am9wmkngopZoUk7YBWhepQO9UBkoOXwi5pL5sTx1oJ6XrIAeiaqZc4qzfFXMk01W1dvw1XxDXsriBodtdsPClMO9cBHhxWPLFwdhoI2A19ejB3Q5pgwWMbbd5t-z_kXWiM2HaK5KKl11s_8ykdVC2tc](https://global.discourse-cdn.com/sailpoint/original/2X/d/dd0a4db9001fa028cb3688c04901b3a0868e8805.png) You must create a new rôle with same criteria with new requiring access and change existing rôle criteria. idn detect that user not meet old role criteria and revoke this rôle and associated access. ---
**Author:** ![RPook](https://avatars.discourse-cdn.com/v4/letter/r/b487fb/32.png) [@RPook](https://developer.sailpoint.com/discuss/u/RPook)\ **Post date:** [February 23, 2024, 4:27pm UTC](https://developer.sailpoint.com/discuss/t/right-sizing-entitlement-membership-after-creating-a-role/31180/4 "2024-02-23T16:27:50Z")
Thanks for the info. Is the same scenario true if we were to use Access Profiles with Roles? EX: Support Rep adds a User to GroupA via ADUC. GroupA is an Entitlement managed under AccessProfileA. The criteria is defined via the Access Profile, not the Role ---
**Author:** ![mehuljogi](https://sea1.discourse-cdn.com/sailpoint/discuss/user_avatar/developer.sailpoint.com/mehuljogi/32/8264_2.png) [@mehuljogi](https://developer.sailpoint.com/discuss/u/mehuljogi)\ **Post date:** [February 23, 2024, 5:45pm UTC](https://developer.sailpoint.com/discuss/t/right-sizing-entitlement-membership-after-creating-a-role/31180/5 "2024-02-23T17:45:30Z")
Hi Ryan, Yes, the same scenario applies if you are using access profiles with roles. ---
**Author:** ![RPook](https://avatars.discourse-cdn.com/v4/letter/r/b487fb/32.png) [@RPook](https://developer.sailpoint.com/discuss/u/RPook)\ **Post date:** [February 26, 2024, 7:28pm UTC](https://developer.sailpoint.com/discuss/t/right-sizing-entitlement-membership-after-creating-a-role/31180/6 "2024-02-26T19:28:34Z")
Thank you for the input. Are there any suggestions or best practices to prevent/alert/remove users who are side-loaded by people/scripts/applications via ADUC? ---
**Author:** ![system](https://global.discourse-cdn.com/sailpoint/original/2X/f/f2136700ed5e3703e0b85e02f6be799dacca7735.png) [@system](https://developer.sailpoint.com/discuss/u/system)\ **Post date:** [April 26, 2024, 7:28pm UTC](https://developer.sailpoint.com/discuss/t/right-sizing-entitlement-membership-after-creating-a-role/31180/7 "2024-04-26T19:28:38Z")
This topic was automatically closed 60 days after the last reply. New replies are no longer allowed.