Role Mining: Discover and Govern the Right IT Roles

Access accumulates quickly in enterprise environments. Users receive permissions based on their responsibilities, teams, and projects, but these permissions are not always organized into reusable roles. Over time, this can lead to excessive direct entitlement assignments that are difficult to manage and govern.

Role mining addresses this by analyzing existing access patterns and identifying opportunities to create structured IT Roles. Instead of designing every role from scratch, organizations can discover roles from the access users already have.

Identity Confluence supports three ways to provision access: Business Roles, IT Roles, and Direct Entitlements, providing a flexible and structured approach to access management.

Why Role Mining Matters

The challenge is not only managing access, but also identifying whether existing permissions can be grouped into meaningful and repeatable roles.

For example, multiple users may have the same application permissions without an IT Role representing that access. Without role mining, these permissions continue to be assigned individually, creating unnecessary direct entitlements and making access harder to standardize.

Role mining reverses this approach. Instead of defining a role first and assigning permissions to it, organizations start with existing access and identify patterns that can be converted into IT Roles.

How Role Discovery Works

Role Discovery analyzes existing access to identify potential IT Roles that have not yet been formally defined.

The workflow is accessible through:

Role Mining → Application → Quick Links → Role Discovering

Before running the discovery, administrators can define parameters that determine which access patterns should be considered.

Minimum Users per Role

Defines the minimum number of users who must share an access pattern for it to qualify as a potential role. This helps prevent highly specific access combinations from becoming unnecessary roles.

Maximum Users per Role

Defines the maximum number of users that can be associated with a discovered role. Together, these parameters help focus discovery on relevant access patterns.

Start Role Discovery

Once the parameters are configured, select Start Role Discovery. Identity Confluence analyzes existing access and presents potential IT Roles along with the permissions associated with each pattern.

Example

Suppose 100 users have direct Jenkins access across four configurations:

• 30 users → Configuration A
• 25 users → Configuration B
• 35 users → Configuration C
• 10 users → Configuration D

Role Discovery identifies these four common access patterns and suggests four IT Roles, one for each configuration, instead of continuing to manage them as individual direct entitlements.

Existing access → Discover pattern → Review permissions → Create IT Role → Govern access

Review Queue: Entitlement Review

Discovery identifies potential roles, but each role still needs to be reviewed before it becomes part of the access model.

The Review Queue provides an Entitlements Review for IT Roles, allowing administrators to validate the permissions associated with each discovered role and ensure that they accurately represent the required access.

Where Role Mining Fits

Role mining is particularly useful when organizations have accumulated significant access data but lack a well-defined role structure. It helps teams:

• Reduce direct entitlement assignments by identifying repeatable access patterns.
• Standardize technical access through reusable IT Roles.
• Discover roles from existing access instead of designing them manually.
• Strengthen governance by reviewing role entitlements before adoption.
• Build a scalable access model based on actual access requirements.

Next Steps

Role mining helps organizations move from scattered permissions to a structured and governed access model. With Identity Confluence, teams can analyze existing access, discover reusable IT Roles, review their entitlements, and reduce reliance on individual Direct Entitlements.