We are assigning a role to a user that includes a Salesforce base permission set and an Entra group from SailPoint ISC. Once the Salesforce account is provisioned with the base permission set, the Salesforce team modifies the permission set to include different permissions. After the Salesforce app …

Either you need to use Certification or SailPoint API to handle the sticky entitlements. Otherwise it will keep trying to provisioning it. I would use Workflow to create a cert campaign to handle the add or remove the permission set when there was a change in the identity access or in attributes.

Hi @suresh4iam , thanks for quick response. We are requesting a role which has entra group nd permission from salesforce. even if i remove from workflow. on identity refresh it assign back the permission right

I remember that setting assignment: true worked for us in one of our implementations. Give it a try below. Account account = getAccount(identity, accountRequest); if(null != idn.getRawAccountAttribute(account, attribute)) { List ents = asList(idn.getRawAccountAttribute(account, attribute…

The workflow can remove all access items like Roles, Access Profiles and Entitlements. You can handle it in the Workflow by using either a Campaign filter to avoid certain access items if you already know it or using Campaign API to make a decision on each access items.

This works for removal i understand. we used same thing for other apps for removal it worked. this usecase for add entitlement. as part of plan if we remove assignment does it work or do we have any other solution

Take a look at Dylan’s blog for a solution to sticky entitlements: [image] Managing Persistent Entitlement Requests in Identity Security Cloud Community Blog [Managing Persistent Entitlement Requests in Identity Security Cloud_Tutorials-Blue] Use Case One of …

Sticky entitlement issue for Salesforce

SailPoint Human Fabric (SHF) SHF Discussion and Questions

justinrhaines (Justin Haines) May 20, 2025, 4:20pm 7

Take a look at Dylan’s blog for a solution to sticky entitlements:

Topic		Replies	Views
Retaining the Previous entitlements IIQ Discussion and Questions identityiq , entitlements	6	1402	September 29, 2023
Managing Persistent Entitlement Requests in Identity Security Cloud Community Blog rules , identity-security-cloud , provisioning , entitlements	3	1223	June 25, 2026
How to Handle Requestable Entitlements and Avoid Stickiness SHF Community Knowledge Base identity-security-cloud , provisioning , entitlements	5	1919	March 14, 2025
Is anyone actually provisioning access to Salesforce? SHF Discussion and Questions identity-security-cloud , provisioning , roles , connectors	1	85	June 11, 2026
Sticky entitlement SHF Discussion and Questions	5	3630	January 3, 2023

Sticky entitlement issue for Salesforce

Related topics