A user authentication method for a software service executing in a virtual machine of a shared computing environment comprising: receiving an indication of a user request to access a restricted resource of the service, the request having associated a user context defining one or more characteristics of the user; retrieving an authentication rule for the service based on the user context, the authentication rule identifying one or more shared authentication facilities for the computing environment; and instantiating one or more authentication facilities in accordance with the authentication rule to generate one or more challenges for the user so as to authenticate the user, wherein the authentication rule further defines one or more parameters for the identified authentication facilities, wherein the service is one of a plurality of services executing in the computing environment, characterised in that the method further comprises: evaluating a measure of entropy for the frequency of use of each of the shared authentication facilities by the services, the measure of entropy indicating a degree of variability of the shared authentication facilities; and in response to a determination that the measure of entropy meets a threshold measure, performing the steps of: a) comparing authentication rules for each of the services to measure similarity of rules to identify a set of services having most similar rules as a consistent set, and to further identify one or more outlier services as services having rules least consistent with the rules of the services in the consistent set; b) generating one or more recommended rules for the outlier services based on the rules of the services in the consistent set. receiving an indication of a user request to access a restricted resource of the service, the request having associated a user context defining one or more characteristics of the user; retrieving an authentication rule for the service based on the user context, the authentication rule identifying one or more shared authentication facilities for the computing environment; and instantiating one or more authentication facilities in accordance with the authentication rule to generate one or more challenges for the user so as to authenticate the user, wherein the authentication rule further defines one or more parameters for the identified authentication facilities, wherein the service is one of a plurality of services executing in the computing environment, characterised in that the method further comprises: evaluating a measure of entropy for the frequency of use of each of the shared authentication facilities by the services, the measure of entropy indicating a degree of variability of the shared authentication facilities; and in response to a determination that the measure of entropy meets a threshold measure, performing the steps of: a) comparing authentication rules for each of the services to measure similarity of rules to identify a set of services having most similar rules as a consistent set, and to further identify one or more outlier services as services having rules least consistent with the rules of the services in the consistent set; b) generating one or more recommended rules for the outlier services based on the rules of the services in the consistent set. evaluating a measure of entropy for the frequency of use of each of the shared authentication facilities by the services, the measure of entropy indicating a degree of variability of the shared authentication facilities; and in response to a determination that the measure of entropy meets a threshold measure, performing the steps of: a) comparing authentication rules for each of the services to measure similarity of rules to identify a set of services having most similar rules as a consistent set, and to further identify one or more outlier services as services having rules least consistent with the rules of the services in the consistent set; b) generating one or more recommended rules for the outlier services based on the rules of the services in the consistent set. a) comparing authentication rules for each of the services to measure similarity of rules to identify a set of services having most similar rules as a consistent set, and to further identify one or more outlier services as services having rules least consistent with the rules of the services in the consistent set; b) generating one or more recommended rules for the outlier services based on the rules of the services in the consistent set.