Multicloud CIEM (after Entra Permissions Management)

Retirement notice: Microsoft Entra Permissions Management (EPM) was retired on October 1, 2025 (end of sale April 1, 2025). Its documentation now lives under previous versions. Microsoft's CIEM capabilities continue in Microsoft Defender for Cloud as the Permissions Management (CIEM) extension of the Defender CSPM plan. For customers who need EPM-equivalent features (Permission Creep Index, on-demand permission grants, auto-generated policies), Microsoft selected Delinea Privilege Control for Cloud Entitlements (PCCE) as the recommended successor.

Cloud Infrastructure Entitlement Management (CIEM) gives visibility and control over permissions for human and non-human identities across Microsoft Azure, AWS, and Google Cloud, driving toward least privilege.

When to use

Discovering and reducing excessive, unused, and over-privileged cloud permissions across a multicloud estate, or planning the move off a retired EPM deployment. For Azure-only RBAC role choice use azure-role-selector; for just-in-time elevation use azure-pim.

Map the goal to the right capability

Rule of thumb: start with inactive identities, then overprovisioned non-human identities that appear on an attack path. Service principals and machine identities typically hold the largest gap between granted and used permissions and rarely fight back when you right-size them.

Approach

1. Migrate off EPM (if still referenced) — Inventory what you used EPM for (PCI reports, on-demand grants, autogenerated policies, alerts to Sentinel). Map each to Defender CSPM CIEM, PIM, cloud-native tools, or Delinea PCCE. Export any historical EPM reports you must retain for audit. Remove EPM-specific runbooks, data collectors, and cross-account roles. Verify: no remaining automation, dashboards, or AWS/GCP roles reference the retired EPM service.
2. Connect each cloud to Defender for Cloud — Azure subscriptions natively; AWS accounts or Organizations and GCP projects or organisations through multicloud connectors. You need Security Admin at subscription (Azure) or account/organisation (AWS/GCP) scope. Verify: each connector shows healthy and resources appear in the inventory.
3. Enable Defender CSPM and turn on Permissions Management (CIEM) — Environment settings → subscription/connector → Defender CSPM → Settings → Permissions Management (CIEM) on. Recommendations appear within a few hours; if CIEM is off they aren't calculated. Verify: CIEM recommendations (overprovisioned / inactive identities) appear for each cloud.
4. Baseline for a representative period — Don't right-size on 7 days of activity. Quarterly business cycles (month-end close, audit) need full coverage — plan on ≥ 90 days of observed activity before aggressive removal.
5. Prioritise by risk, not count — Start with identities on attack paths or with access to sensitive / internet-exposed resources (Cloud Security Explorer), then inactive identities, then the rest of the overprovisioned list. Verify: top-risk identities on attack paths reduced sprint over sprint.
6. Tackle non-human identities first — Service principals, managed identities, AWS IAM roles, GCP service accounts. They're often the most over-privileged and the least disruptive to fix (see entra-workload-identity).
7. Right-size and replace standing access — Remove unused permissions using the recommendation's remediation guidance; for AWS unused-action detail use IAM last accessed information directly in AWS. Convert rarely-used high privilege to PIM (Azure/Entra) or equivalent just-in-time access in other clouds.
8. Monitor + alert — Track CIEM recommendation counts and secure score trend monthly; stream Defender for Cloud alerts and recommendations to Sentinel / Defender XDR for SOC correlation.

Guardrails

• Validate activity baselines cover a representative period (90 days minimum) before aggressively right-sizing. Anything less misses quarterly or month-end-only workflows and causes outages.
• Test in a non-production workload first. A right-sized policy that breaks a CI/CD pipeline at 02:00 is worse than the over-privilege.
• Treat machine/workload identities explicitly - they often hold the largest unused permission gap and rarely fight back when you right-size them. Address them first.
• Coordinate remediation with workload owners. Right-sizing without informing the owner of the service account causes outages and erodes trust in the programme.
• Don't right-size break-glass / emergency access roles. Document the exceptions.
• Don't design new work on Entra Permissions Management. It's retired; any EPM guidance, scripts, or Permission Creep Index KPIs need a replacement in Defender CSPM or Delinea PCCE.

Common anti-patterns

• "Right-size after 2 weeks of data" - Misses month-end. Outage.
• "Keep using EPM reports and PCI as the KPI" - The service is retired; move the KPI to CIEM recommendation counts and attack-path reduction.
• "Start with the longest list of unused permissions" - Many small wins, no risk reduction. Start with identities on attack paths and inactive identities.
• "Right-size humans first because there are more of them" - Humans push back; non-humans don't. Non-humans usually carry the highest unused privilege.
• "Apply permission changes directly to production" - Test workload first.
• "Onboard only one cloud at a time over months" - Loses the multicloud visibility that is the entire point. Connect all clouds in the same sprint.

Example prompts

• We used Entra Permissions Management — what replaces it and how do we migrate?
• Enable CIEM in Defender CSPM for our Azure, AWS, and GCP environments.
• Find overprovisioned and inactive identities across all three clouds and propose a remediation order.
• Which service principals with excessive permissions sit on an attack path to sensitive data?
• Replace EPM on-demand permission requests for Azure with PIM.
• Build a monthly CIEM posture report for leadership.

Microsoft Learn

• CIEM in Defender for Cloud: https://learn.microsoft.com/azure/defender-for-cloud/permissions-management
• Enable CIEM (Defender CSPM): https://learn.microsoft.com/azure/defender-for-cloud/enable-permissions-management
• Enable Defender CSPM: https://learn.microsoft.com/azure/defender-for-cloud/tutorial-enable-cspm-plan
• Identity and access recommendations: https://learn.microsoft.com/azure/defender-for-cloud/recommendations-reference-identity-access
• Cloud Security Explorer: https://learn.microsoft.com/azure/defender-for-cloud/how-to-manage-cloud-security-explorer
• Attack path analysis: https://learn.microsoft.com/azure/defender-for-cloud/how-to-manage-attack-path
• Connect AWS: https://learn.microsoft.com/azure/defender-for-cloud/quickstart-onboard-aws
• Connect GCP: https://learn.microsoft.com/azure/defender-for-cloud/quickstart-onboard-gcp
• Entra Permissions Management (retired, previous versions): https://learn.microsoft.com/previous-versions/entra/permissions-management/overview