# Workflow - Disable Account once Access Profile/Entitlement is removed

**URL:** <https://developer.sailpoint.com/discuss/t/workflow-disable-account-once-access-profile-entitlement-is-removed/73569>\
**Category:** SHF Discussion and Questions\
**Tags:** identity-security-cloud, workflows\
**Created:** [July 21, 2024, 3:36pm UTC](https://developer.sailpoint.com/discuss/t/workflow-disable-account-once-access-profile-entitlement-is-removed/73569 "2024-07-21T15:36:04Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![kevinkhiev](https://avatars.discourse-cdn.com/v4/letter/k/aca169/32.png) [@kevinkhiev](https://developer.sailpoint.com/discuss/u/kevinkhiev)\
**Post date:** [July 21, 2024, 3:36pm UTC](https://developer.sailpoint.com/discuss/t/workflow-disable-account-once-access-profile-entitlement-is-removed/73569/1 "2024-07-21T15:36:04Z")

</div>

Needing some assistance with building a workflow to disable an account once an access profile or entitlement is removed from the user profile. Here is what I started building, any guidance will be appreciated!

Using trigger “Native Change Account Update”  
Starting filter with: $.entitlementChanges.removed

Follow by Action “Get access” to select the identity, Action “Manage Accounts” to disable the account. - End Step.

---

<div class="post-metadata">

**Author:** ![Anshu\_Kunal](https://sea1.discourse-cdn.com/sailpoint/discuss/user_avatar/developer.sailpoint.com/anshu_kunal/32/14680_2.png) [@Anshu\_Kunal](https://developer.sailpoint.com/discuss/u/Anshu_Kunal)\
**Post date:** [July 22, 2024, 5:44am UTC](https://developer.sailpoint.com/discuss/t/workflow-disable-account-once-access-profile-entitlement-is-removed/73569/2 "2024-07-22T05:44:48Z")

</div>

@kevinkhiev

Steps looks good (until tested) but you would need to add a step to identify name of the source for which native change was detected as workflow will run for all sources.

If users has multiple entitlements on source then you need to verify if all entitlement has been removed before proceeding for disable operation which will require a loop operator.

**Just a word of caution** : It will become a challenge (no list operator available on workflow) if user has multiple entitlements on source and native change has not deleted/detected that all entitlements so ideally disable operation shouldn’t be triggered.

Small correction in filter

> $.entitlementChanges[?(@.attributeName==entitlement type of source)].removed

---

<div class="post-metadata">

**Author:** ![kevinkhiev](https://avatars.discourse-cdn.com/v4/letter/k/aca169/32.png) [@kevinkhiev](https://developer.sailpoint.com/discuss/u/kevinkhiev)\
**Post date:** [July 22, 2024, 4:35pm UTC](https://developer.sailpoint.com/discuss/t/workflow-disable-account-once-access-profile-entitlement-is-removed/73569/3 "2024-07-22T16:35:26Z")

</div>

Thank you Anshu.

Maybe I’m entering the trigger filter wrong, I have tried these two below, but it doesn’t seem to trigger off:  
Example:  
$.entitlementChanges[?(@.attributeName==“Name of entitlement”)].removed  
and  
$.entitlementChanges[?(@.id==“ID number”)].removed

within my other step I’m also using “Manage Accounts” specifying which account I want disabled and the action “Disable Accounts”:

Example:  
$.getAccounts.accounts[‘AD - Account source -’].id

---

<div class="post-metadata">

**Author:** ![Anshu\_Kunal](https://sea1.discourse-cdn.com/sailpoint/discuss/user_avatar/developer.sailpoint.com/anshu_kunal/32/14680_2.png) [@Anshu\_Kunal](https://developer.sailpoint.com/discuss/u/Anshu_Kunal)\
**Post date:** [July 22, 2024, 5:10pm UTC](https://developer.sailpoint.com/discuss/t/workflow-disable-account-once-access-profile-entitlement-is-removed/73569/4 "2024-07-22T17:10:57Z")

</div>

Kevin,

> $.entitlementChanges[?(@.attributeName==“_ **Type of entitlement** _”)].removed

**Type of entitlement** → memberOf, group, role etc

Thanks

---

<div class="post-metadata">

**Author:** ![system](https://global.discourse-cdn.com/sailpoint/original/2X/f/f2136700ed5e3703e0b85e02f6be799dacca7735.png) [@system](https://developer.sailpoint.com/discuss/u/system)\
**Post date:** [September 20, 2024, 5:11pm UTC](https://developer.sailpoint.com/discuss/t/workflow-disable-account-once-access-profile-entitlement-is-removed/73569/5 "2024-09-20T17:11:37Z")

</div>

This topic was automatically closed 60 days after the last reply. New replies are no longer allowed.