Hi @lansinliu
I am not aware of any “limitations” to AI Access Modeling, with respect to the number of identities for a role mining session. The scalability of the platform allows for *n* number of identities. Some tenants have 500, others 100,000+ identities.
Related to your entitlements questions, I may be confused at your meaning and intention, because we cannot “Mine” on entitlements. When you execute a search query against entitlements, the Role Discovery button is greyed out. We cannot Discover Roles from a set of entitlements. Role mining via a search query is limited to identity-focused queries in Identity Security Cloud. Further, entitlement suggestions from the AI Algorithm are added to Role insights page after the nightly refresh. There is no further role mining or time elapsed to see which entitlements are recommended for inclusion in existing roles, when you enter that page every morning.
Also, it is not possible to determine exactly how long process take to complete in any technological platform, because there are a number of factors to consider. For you, the same search query could take 5 seconds today and 7 seconds tomorrow, because the network speed is slower that day, more data was added to the tenant, etc. The same search query from a different geo at the exact same time could vary. But I have found, in general, that larger data sets do take longer to get results. And with role mining, we are talking about mathematical computations - the more there are, the longer it potentially could take.
To illustrate that, I can provide a sample experience from my own test environment of 9504 identities.
TEST1: Common Access Role mining for 7000+ identities:
- The Search query “*” took 2-3 seconds (result set = 9504 identities)
- The Search query “_exists_:attributes.cloudLifecycleState AND attributes.cloudLifecycleState:active” took 1-2 seconds just now, and returned 7423 identities.
- From that query and result set of 7423 identities, the elapsed time between clicking on Role Discovery > Discover Common Access Roles and the page loading with results took ~42 seconds.
TEST2: Specialized access role mining for 4 identities:
- Search query “attributes.department:Accounting AND attributes.jobTitle:“Accounts Payable”” results in 4 identities, takes 1.2 seconds.
- Time elapsed between Role Discovery > Discover Specialized Roles to results page == 2.3 seconds.
In summary, my limited test scenario proves that YES, larger data sets IN MY OWN SANDBOX TENANT tend to take longer to role mine.
REASON: The algorithm is looking at a subset of identities’’ entitlement similarities. The larger the data set of identities to compare AND the more entitlements they collectively hold, the more calculations to be executed, and, thus, the longer it potentially takes to complete the process and return results back to you in the browser. Are we talking hours? Not at all. Seconds to minutes, always depending on the data set to be analyzed. Even the message you see in the browser while it is executing the calculations says “This could take a few minutes.” That would be my expectation.
I hope this is helpful.
