# Single Entitlement Request for Specific Applications **URL:** \ **Category:** IIQ Discussion and Questions\ **Tags:** access-requests, identityiq\ **Created:** [March 9, 2026, 9:51am UTC](https://developer.sailpoint.com/discuss/t/single-entitlement-request-for-specific-applications/198927 "2026-03-09T09:51:51Z")\ **Posts on this page:** 9\ **Page:** 1
**Author:** ![satishbabu](https://avatars.discourse-cdn.com/v4/letter/s/45deac/32.png) [@satishbabu](https://developer.sailpoint.com/discuss/u/satishbabu)\ **Post date:** [March 9, 2026, 9:51am UTC](https://developer.sailpoint.com/discuss/t/single-entitlement-request-for-specific-applications/198927/1 "2026-03-09T09:51:51Z")
## Which IIQ version are you inquiring about? We have a requirement where a user should be able to select **only one entitlement for a specific application (Through Manage User Access)**. - This restriction should apply **only to that particular application** , not to all applications. - If the user tries to select **more than one entitlement** for that application, the system should display a **popup message** informing the user that only one entitlement can be selected. ## Looking forward… **Thanks in advance.** ---
**Author:** ![neel193](https://sea1.discourse-cdn.com/sailpoint/discuss/user_avatar/developer.sailpoint.com/neel193/32/34038_2.png) [@neel193](https://developer.sailpoint.com/discuss/u/neel193)\ **Post date:** [March 9, 2026, 10:21am UTC](https://developer.sailpoint.com/discuss/t/single-entitlement-request-for-specific-applications/198927/2 "2026-03-09T10:21:59Z")
@satishbabu Please check this thread: [Custom Message Popup on Manage User Access Screen - #11 by Peddapolu](https://developer.sailpoint.com/discuss/t/custom-message-popup-on-manage-user-access-screen/198255/11) I shared a sample plugin that blocks the request flow if items are more than certain number. I believe this should work in your case as well, where instead of checking all the line items, you can check for specific apps and throw the popup. please let me know if it help, i can share the sample plugin over chat. ---
**Author:** ![satishbabu](https://avatars.discourse-cdn.com/v4/letter/s/45deac/32.png) [@satishbabu](https://developer.sailpoint.com/discuss/u/satishbabu)\ **Post date:** [March 9, 2026, 12:09pm UTC](https://developer.sailpoint.com/discuss/t/single-entitlement-request-for-specific-applications/198927/3 "2026-03-09T12:09:58Z")
Hi @neel193 Thanks for your response i didn’t see any Plugin Related codes in the shared thread! ---
**Author:** ![neel193](https://sea1.discourse-cdn.com/sailpoint/discuss/user_avatar/developer.sailpoint.com/neel193/32/34038_2.png) [@neel193](https://developer.sailpoint.com/discuss/u/neel193)\ **Post date:** [March 9, 2026, 12:57pm UTC](https://developer.sailpoint.com/discuss/t/single-entitlement-request-for-specific-applications/198927/4 "2026-03-09T12:57:41Z")
@satishbabu Code is not there in the post. I shared it for the context. If your requirement is like the other thread, i can share the details over chat. ---
**Author:** ![naveenkumar3](https://sea1.discourse-cdn.com/sailpoint/discuss/user_avatar/developer.sailpoint.com/naveenkumar3/32/39339_2.png) [@naveenkumar3](https://developer.sailpoint.com/discuss/u/naveenkumar3)\ **Post date:** [March 10, 2026, 1:08am UTC](https://developer.sailpoint.com/discuss/t/single-entitlement-request-for-specific-applications/198927/5 "2026-03-10T01:08:03Z")
Create a small plugin to achieve it. In manage user access page, are we doing any filtering?? is yes, which filter you are using?? Please confirm. This should be a simple plugin to achieve. ---
**Author:** ![tharshith](https://sea1.discourse-cdn.com/sailpoint/discuss/user_avatar/developer.sailpoint.com/tharshith/32/34929_2.png) [@tharshith](https://developer.sailpoint.com/discuss/u/tharshith)\ **Post date:** [March 11, 2026, 1:37pm UTC](https://developer.sailpoint.com/discuss/t/single-entitlement-request-for-specific-applications/198927/6 "2026-03-11T13:37:05Z")
Hi @satishbabu We’ve got a similar requirement earlier and we’ve dealt it with Advanced Policy. In Advanced policy you can write the policy violation rule and return violation based on your conditions ---
**Author:** ![satishbabu](https://avatars.discourse-cdn.com/v4/letter/s/45deac/32.png) [@satishbabu](https://developer.sailpoint.com/discuss/u/satishbabu)\ **Post date:** [March 11, 2026, 3:58pm UTC](https://developer.sailpoint.com/discuss/t/single-entitlement-request-for-specific-applications/198927/7 "2026-03-11T15:58:54Z")
Hi Harshith thanks for the input. Could you please share a sample rule if you have one? ---
**Author:** ![tharshith](https://sea1.discourse-cdn.com/sailpoint/discuss/user_avatar/developer.sailpoint.com/tharshith/32/34929_2.png) [@tharshith](https://developer.sailpoint.com/discuss/u/tharshith)\ **Post date:** [March 12, 2026, 12:53pm UTC](https://developer.sailpoint.com/discuss/t/single-entitlement-request-for-specific-applications/198927/8 "2026-03-12T12:53:49Z")
Please find it below ```auto import sailpoint.api.SailPointContext; import sailpoint.api.IdentityService; import sailpoint.object.*; import sailpoint.tools.*; import org.apache.commons.logging.Log; import org.apache.commons.logging.LogFactory; boolean checkIdentityHasApplicationLink(String identityName, String appName) { boolean hasAccess = false; Identity identity = context.getObjectByName(Identity.class,identityName); if(null != identity) { IdentityService ids = new IdentityService(context); Application app = context.getObjectByName(Application.class, appName); if(null != app) { List links = ids.getLinks(identity,app); if(Util.nullSafeSize(links) > 0){ hasAccess = true; } } } return hasAccess; } boolean violate = false; boolean isPendingRoleConflict = false; boolean hasApplicationAccess = false; PolicyViolation v = null; String appName = "Your App name"; String entitlementName = "ROLES"; Application app = context.getObjectByName(Application.class, appName); List entitlementsList = new ArrayList(); entitlementsList.add("ROLES"); boolean hasApplicationAccess = checkIdentityHasApplicationLink(identity.getName(), appName); if( app != null ) { IdentityService ids = new IdentityService(context); if( ids != null ) { List listLink = ids.getLinks(identity,app); if( listLink != null ) { for(Link l : listLink) { Attributes atts = l.getEntitlementAttributes(); if( atts != null ) { Object entitlements = atts.get(entitlementName); if( entitlements != null ) { if(entitlements != null && entitlements instanceof ArrayList && ((entitlements.size() > 1 && !hasApplicationAccess) || (entitlements.size() > 2 && hasApplicationAccess) || (entitlements.size() > 1 && atts.size()> 2 && hasApplicationAccess))) { violate = true; break; } else { violate = false; } } } } } } } if (violate) { v = new PolicyViolation(); v.setActive(true); v.setIdentity(identity); v.setPolicy(policy); v.setConstraint(constraint); v.setDescription("Single access SOD for: " + appName); v.setStatus(sailpoint.object.PolicyViolation.Status.Open); } return v; ``` ---
**Author:** ![system](https://global.discourse-cdn.com/sailpoint/original/2X/f/f2136700ed5e3703e0b85e02f6be799dacca7735.png) [@system](https://developer.sailpoint.com/discuss/u/system)\ **Post date:** [May 11, 2026, 12:54pm UTC](https://developer.sailpoint.com/discuss/t/single-entitlement-request-for-specific-applications/198927/9 "2026-05-11T12:54:42Z")
This topic was automatically closed 60 days after the last reply. New replies are no longer allowed.