Identity Manager

How to remove ADSUSER from ADSGROUP in ADSACCOUNTinADSGROUP table when inherited?

I'm looking for a solution for removing users from group memberships through IDM when users request access through the IT Shop (PersonWantOrg).  We often need to decommission groups when applications are removed from our environment, but when groups have several user memberships in the ADSACCOUNTinADSGROUP table we are not able to accomplish this task if these users requested access through IT Shop and the records are inherited.