Skip to main content

​
What is role mining?

Role mining analyzes the access granted to your organization’s users and identifies patterns that suggest well-defined access profiles. Instead of building access profiles by hand, you can use role mining to let C1 surface which entitlements are commonly held by similar groups of people, then turn those patterns into ready-to-use profiles.

​
How role mining works

Role mining answers a specific question: “What access does this group of people typically need?” It starts with a defined group — a department, job title, employment status, manager’s team, or another cohort — and discovers the entitlements that group commonly holds. If you’re starting from a specific entitlement and want to know who should have it, role mining isn’t the right tool. Use Governance > Access profiles to build profiles by selecting entitlements directly.

​
Before you begin

  • You must have the Super Admin role in C1 to use role mining.
  • At least one connector must be configured and have completed a sync. Role mining analyzes existing access grants, so it requires data to work with.

​
Run a role mining analysis

1
Navigate to Governance > Role mining.
2
In the Filter section, click Add filter, then select a user attribute — such as Department, Job title, Manager, or Employment status.
3
Select one or more values for the attribute. Each value shows how many users hold it and what share of your directory that represents. Click Done to collapse the value picker — this doesn’t change your selections. To reopen the picker and change your selected values, click the down arrow next to the value count in the selection box.
4
Add more filters as needed with Add filter. C1 updates the results as you build your cohort.

​
Set the shared-access threshold

Once your cohort has at least one match, the Select shared access control lets you decide how common an entitlement must be in the cohort before it’s included in the results. Enter a percentage in the box or drag the slider — the two stay in sync — to set the cutoff (80% by default). The histogram beneath it shows how entitlements are distributed across the cohort, from entitlements everyone holds (100%) to entitlements almost no one holds (0%). Four summary cards update as you adjust the cutoff:
  • Selected — the number of entitlements included at the current cutoff.
  • Core holders — how many members of the cohort hold every selected entitlement.
  • Reach — the percentage of the cohort covered by the selected entitlements, and how many members are missing at least one.
  • Makeup — the number of applications represented in the selected entitlements, and how many are high or medium risk.

​
Review the results

The results appear in two tabs:
  • Users — the users who match your current filters, with their status, job title, and entitlement count.
  • Entitlements — the entitlements at or above your shared-access cutoff, with a coverage bar (the share of the cohort that holds each one) and a grant count. Check or uncheck individual entitlements to fine-tune the set before taking action. Turn on Show selected only to filter the list down to your current selections. An entitlement shows a Deleted badge if the underlying resource has been removed from its source system.

​
Take action on your results

The action bar at the bottom of the page shows a summary of the current cohort (for example, “7 of the 18 users have the 100 entitlements selected”) and two actions:
  • Create access profile — opens a modal where you name the profile, optionally enable membership automation, and review the selected entitlements. When membership automation is enabled, C1 generates a CEL expression from your filters and automatically enrolls users who match it. Turn on Create access request tasks for membership changes to route those automatic enrollments through an access request task for approval, instead of enrolling matching users immediately.
  • Add to existing profile — opens a modal to add the cohort’s selected entitlements to an access profile you’ve already created.

​
Revisit past analyses

Click History in the upper right to open the Recent analyses drawer. It lists your past filter combinations with timestamps. Click Run again next to any entry to rerun that analysis.
Role mining becomes more accurate as your organization’s data grows. If you’ve recently connected new integrations or enrolled more users in access profiles, running a fresh analysis surfaces more relevant suggestions.

​
Frequently asked questions about role mining

Role mining requires users with existing access grants to analyze. If your connectors haven’t completed a sync, if the cohort you’ve defined is too small, or if user attributes aren’t mapped in your directory, results may not appear. Try running a connector sync, confirm that user attributes are mapped, and then rerun your analysis.
C1 creates the access profile with the entitlements from your cohort. If you enabled membership automation, users who match the profile’s CEL expression are enrolled automatically and kept in sync as your organization changes — unless you also enabled Create access request tasks for membership changes, in which case matching users get an access request task instead of immediate enrollment. If you didn’t enable automation, the profile starts with no enrolled members — add members from the profile’s Enrollment tab.