Skip to main content

​
What is role mining?

Role mining analyzes the access granted to your organization’s users and identifies patterns that suggest well-defined access profiles. Instead of building access profiles by hand, you can use role mining to let C1 surface which entitlements are commonly held by similar groups of people, then turn those patterns into ready-to-use profiles.

​
How role mining works

Role mining answers a specific question: “What access does this group of people typically need?” It starts with a defined group — a department, job title, employment status, manager’s team, or another cohort — and discovers the entitlements that group commonly holds. If you’re starting from a specific entitlement and want to know who should have it, role mining isn’t the right tool. Use Governance > Access profiles to build profiles by selecting entitlements directly.

​
Before you begin

  • You must have the Super Admin role in C1 to use role mining.
  • At least one connector must be configured and have completed a sync. Role mining analyzes existing access grants, so it requires data to work with.

​
Run a role mining analysis

1
Navigate to Governance > Role mining.
2
In the Filter section, click + Add filter. Select a user attribute — such as Department, Job title, Manager, or Employment status — then select one or more values.
3
Add more filters as needed with + Add filter. C1 updates the results as you build your cohort.
The results appear in two tabs:
  • Users — the users who match your current filters, with their status, job title, and entitlement count.
  • Entitlements — the entitlements held by users in the cohort.
Suggested refinements appear as chips above the results. Click any chip to add it as a filter and narrow the cohort further.

​
Take action on your results

The action bar at the bottom of the page shows a summary of the current cohort (for example, “7 of the 18 users have the 100 entitlements selected”) and two actions:
  • Create access profile — opens a modal where you name the profile, optionally enable membership automation, and review the entitlements. When membership automation is enabled, C1 generates a CEL expression from your filters and automatically adds users who match it to the profile.
  • Add to existing profile — opens a modal to add the cohort’s entitlements to an access profile you’ve already created.

​
Revisit past analyses

Click History in the upper right to open the Recent analyses drawer. It lists your past filter combinations with timestamps. Click Run again next to any entry to rerun that analysis.
Role mining becomes more accurate as your organization’s data grows. If you’ve recently connected new integrations or enrolled more users in access profiles, running a fresh analysis surfaces more relevant suggestions.

​
Frequently asked questions about role mining

Role mining requires users with existing access grants to analyze. If your connectors haven’t completed a sync, if the cohort you’ve defined is too small, or if user attributes aren’t mapped in your directory, results may not appear. Try running a connector sync, confirm that user attributes are mapped, and then rerun your analysis.
C1 looks at the attributes shared among users in your current cohort — such as employment status, manager, or workspace — and surfaces the ones that appear most consistently as filter chips. Clicking a chip adds that attribute as a filter, narrowing the cohort to users who share both the original filters and the refinement.
C1 creates the access profile with the entitlements from your cohort. If you enabled membership automation, users who match the profile’s CEL expression are enrolled automatically and kept in sync as your organization changes. If you didn’t enable automation, the profile starts with no enrolled members — add members from the profile’s Enrollment tab.