# Sticky entitlement

**URL:** <https://developer.sailpoint.com/discuss/t/sticky-entitlement/2026>\
**Category:** SHF Discussion and Questions\
**Created:** [November 10, 2021, 2:47pm UTC](https://developer.sailpoint.com/discuss/t/sticky-entitlement/2026 "2021-11-10T14:47:53Z")\
**Posts on this page:** 7\
**Page:** 1

<div class="post-metadata">

**Author:** ![srimathiraman](https://avatars.discourse-cdn.com/v4/letter/s/bcef8e/32.png) [@srimathiraman](https://developer.sailpoint.com/discuss/u/srimathiraman)\
**Post date:** [November 10, 2021, 2:47pm UTC](https://developer.sailpoint.com/discuss/t/sticky-entitlement/2026/1 "2021-11-10T14:47:53Z")

</div>

Hi,  
As part of leavers, we assign an access profile to trigger the before provisioning rule. In Before provisioning rule for AD we are trying to remove all the AD entitlements.

Scenario1  
User does not have entitlement that was granted as part of access request from IDN. Before provisioning works fine and it removes all entitlements.

Scenario2  
User have entitlement that was granted as part of access request from IDN. Before provisioning works fine and it removes all entitlements. However after running the AD aggregation and identity refresh the entitlements assigned via the access request is getting assigned back.  
I have seen this similar sticky entitlement issue in Sailpoint IdentityIQ.  
[https://community.sailpoint.com/t5/IdentityIQ-Wiki/What-s-sticky-AttributeAssignment-and-how-to-delete-it/ta-p/194560](https://community.sailpoint.com/t5/IdentityIQ-Wiki/What-s-sticky-AttributeAssignment-and-how-to-delete-it/ta-p/194560)

Question: Do we have sticky entitlement or Access profile in IDN?

Thanks,  
Srimathi

---

<div class="post-metadata">

**Author:** ![srimathiraman](https://avatars.discourse-cdn.com/v4/letter/s/bcef8e/32.png) [@srimathiraman](https://developer.sailpoint.com/discuss/u/srimathiraman)\
**Post date:** [November 15, 2021, 12:52pm UTC](https://developer.sailpoint.com/discuss/t/sticky-entitlement/2026/2 "2021-11-15T12:52:56Z")

</div>

@colin_mckibben , Is Sticky entitlement issue there in IdentityNow as well?

---

<div class="post-metadata">

**Author:** ![cpatel](https://avatars.discourse-cdn.com/v4/letter/c/48db29/32.png) [@cpatel](https://developer.sailpoint.com/discuss/u/cpatel)\
**Post date:** [July 4, 2022, 5:14am UTC](https://developer.sailpoint.com/discuss/t/sticky-entitlement/2026/3 "2022-07-04T05:14:12Z")

</div>

> [@srimathiraman](#):
>
> y entitlement issue there in IdentityNow as well?

It is there if you use “Roles” in request centre but if you use “Applications” in request centre you would not see this issue.  
Roles are refreshed as part of scheduled refresh but applications are not. Though you can only have one source under application and cannot combine access from different sources like roles.

---

<div class="post-metadata">

**Author:** ![tuliszet](https://avatars.discourse-cdn.com/v4/letter/t/e79b87/32.png) [@tuliszet](https://developer.sailpoint.com/discuss/u/tuliszet)\
**Post date:** [July 4, 2022, 7:20am UTC](https://developer.sailpoint.com/discuss/t/sticky-entitlement/2026/4 "2022-07-04T07:20:49Z")

</div>

I’m not quite sure that it happens only if “Roles” are used.  
We have some very troublesome situations in our tenants related to those “Sticky Entitlements” for SCIM Sources.

Scenario:

- Entitlement was granted as part of IdN Access Request. The request was made for requestable entitlement so not linked to the specific application.
- Later in time, these permissions were deleted on the source side. After entitlement aggregation, it was also deleted from IdN.
- From now on, IdN is constantly trying to reassign this deleted entitlement to users that have it before it was removed as permission on the source side.

This is very very troublesome behavior. Is there any way to control/disable this ‘automatic reassignment’?

---

<div class="post-metadata">

**Author:** ![cpatel](https://avatars.discourse-cdn.com/v4/letter/c/48db29/32.png) [@cpatel](https://developer.sailpoint.com/discuss/u/cpatel)\
**Post date:** [July 4, 2022, 10:19am UTC](https://developer.sailpoint.com/discuss/t/sticky-entitlement/2026/5 "2022-07-04T10:19:55Z")

</div>

This should be looked by support. Deletion of entitlement has always been somewhat tricky considering entitlements come from 2 different aggregation dataset. There was change made in past to consider entitlement aggregation as source of truth even though they are coming from account aggregation.

---

<div class="post-metadata">

**Author:** ![udayputta](https://sea1.discourse-cdn.com/sailpoint/discuss/user_avatar/developer.sailpoint.com/udayputta/32/14195_2.png) [@udayputta](https://developer.sailpoint.com/discuss/u/udayputta)\
**Post date:** [January 3, 2023, 11:25am UTC](https://developer.sailpoint.com/discuss/t/sticky-entitlement/2026/6 "2023-01-03T11:25:35Z")

</div>

Hi Srimathi Raman,

Can I know if you have fixed this sticky entitlement issue. If yes can we know how did you resolve this. We are also facing similar problem in identity now and trying to get it resolved with SailPoint team.

Thank,  
Uday

---

<div class="post-metadata">

**Author:** ![system](https://global.discourse-cdn.com/sailpoint/original/2X/f/f2136700ed5e3703e0b85e02f6be799dacca7735.png) [@system](https://developer.sailpoint.com/discuss/u/system)\
**Post date:** [July 19, 2023, 2:22pm UTC](https://developer.sailpoint.com/discuss/t/sticky-entitlement/2026/7 "2023-07-19T14:22:15Z")

</div>


