| Microsoft Entra Permissions Management was a cloud security tool that helped organizations identify excessive permissions across Microsoft Azure, AWS, and Google Cloud, reducing unnecessary access and giving IT teams greater control over cyber risk. Although Microsoft retired the product in 2025, organizations can still strengthen cloud security, enforce least-privilege access, and demonstrate better risk management through alternatives such as Microsoft Defender for Cloud and Delinea Privilege Control for Cloud Entitlements (PCCE). |
Is Microsoft Entra Permissions Management Still Available?
No. Microsoft Entra Permissions Management was officially retired on November 1, 2025. The standalone Cloud Infrastructure Entitlement Management (CIEM) product is no longer available, and Microsoft has ended support and offboarded remaining customers.
Here’s how the retirement unfolded:
- April 1, 2025: Microsoft stopped selling the product to new Enterprise Agreement (EA) and direct customers.
- May 1, 2025: Sales ended for new customers purchasing through Microsoft’s Cloud Solution Provider (CSP) program.
- September 29, 2025: Microsoft extended the original October 1 retirement deadline by one month, giving existing customers more time to transition.
- November 1, 2025: The product officially retired, support ended, and remaining customers were automatically offboarded.
Why Canadian Organizations Need to Be Aware of the Retirement of Entra Permissions Management
Organizations that relied on Microsoft Entra Permissions Management for visibility into cloud access lost a dedicated security tool when Microsoft retired it in 2025.
But retiring the product didn’t eliminate the need for permissions governance.
IT leaders must now reassess their security strategies, existing investments, and ability to identify excessive cloud permissions.
Across Microsoft Azure, AWS, and Google Cloud, unused and excessive permissions increase the risk of unauthorized access, privilege escalation, and lateral movement.
Without equivalent monitoring and remediation capabilities, excessive permissions can go undetected. Organizations need to evaluate replacement solutions against their existing security requirements, maintain least-privilege access, and ensure cloud identity risks remain visible and manageable.
How Did Microsoft Entra Permissions Management Work?
Microsoft Entra Permissions Management helped organizations understand who had access to their cloud environments, what they could do, and whether they actually needed those permissions.
By identifying unnecessary access and helping teams address it, the platform supported stronger security controls without getting in the way of everyday operations.
What Was Microsoft Entra Permissions Management?
Microsoft Entra Permissions Management was a standalone CIEM solution designed to help organizations discover, monitor, and manage cloud access permissions. As part of Microsoft’s identity security portfolio, it helped IT teams reduce excessive privileges, improve access governance, and support Zero Trust security.
The platform brought visibility into human and workload identities across Microsoft Azure, AWS, and GCP. Instead of managing permissions across disconnected environments, security teams could identify risks, automate certain remediation activities, and continuously monitor access from a centralized platform.
Although Microsoft retired Entra Permissions Management in November 2025, the need for these controls hasn’t changed. Organizations can still access CIEM capabilities through Microsoft Defender for Cloud, helping them maintain visibility into cloud permissions and reduce unnecessary access.
How Did Entra Permissions Management Identify Excessive Cloud Permissions?
A key feature was the Permissions Creep Index (PCI), which helped security teams identify identities with more permissions than their activity required. Combined with permissions usage analytics, PCI made it easier to prioritize high-risk access, remove unused privileges, and give users or workloads only the permissions they needed.
These insights supported least-privilege access and Zero Trust security, helping organizations reduce unnecessary exposure while maintaining productivity. Microsoft Defender for Cloud continues to offer CIEM functionality, but PCI-based recommendations were discontinued in February 2026 in favour of updated activity-based analysis.
The Microsoft Permissions Management Options Available Today
Organizations can still manage cloud permissions using Microsoft and third-party security solutions. The right choice depends on your cloud infrastructure, the identities you need to protect, and how effectively your IT team can identify unnecessary access.
Microsoft Defender for Cloud
Microsoft Defender for Cloud continues to offer CIEM capabilities through its paid Defender Cloud Security Posture Management (Defender CSPM) plan. It helps organizations discover identities and permissions across Azure, AWS, and Google Cloud, identify excessive or inactive access, and prioritize security risks.
With tools such as Cloud Security Explorer and attack path analysis, IT teams can better understand which permissions create meaningful exposure and where to focus remediation efforts. This helps turn complex cloud security findings into clearer priorities, rather than adding more alerts to an already busy IT team’s workload.
Delinea Privilege Control for Cloud Entitlements
For organizations that need dedicated multicloud permissions management, Delinea PCCE is Microsoft’s designated partner alternative to the retired product.
Delinea PCCE provides continuous entitlement discovery, permissions usage analysis, and risk scoring across Azure, AWS, and Google Cloud. It helps organizations manage access for both human and non-human identities, identify unnecessary privileges, and enforce least-privilege policies.
Businesses considering the platform should evaluate how its capabilities, integrations, migration requirements, and licensing align with their existing environment.
Microsoft Entra Privileged Identity Management
Microsoft Entra Privileged Identity Management (PIM) helps organizations control who receives privileged access to Microsoft Entra ID and Azure resources, and for how long.
Through just-in-time access, approval workflows, time-limited assignments, and access reviews, IT teams can reduce standing administrative privileges without slowing down legitimate work.
However, PIM is not a direct replacement for Microsoft Entra Permissions Management. While it helps govern privileged Microsoft roles, it does not provide the same continuous discovery and analysis of cloud entitlements across Azure, AWS, and Google Cloud.
Broader Microsoft Identity Security Capabilities
Cloud permissions management doesn’t operate in isolation. Microsoft Entra ID, Entra ID Governance, and Entra Workload ID provide additional controls to help organizations manage authentication, access lifecycles, and application identities.
Together with Microsoft Defender for Cloud, these capabilities can help organizations build a more coordinated approach to identity security.
Choosing the Right Cloud Permissions Management Approach
Businesses operating across multiple cloud providers may need dedicated CIEM capabilities to gain deeper visibility into entitlements and consistently manage excessive permissions.
Before investing in another solution, consider what your existing Microsoft licenses already provide, which human and workload identities need protection, and whether your current tools can actually help your team remediate risks.
Microsoft Entra Permissions Management Alternatives
| Solution | Primary Function | Cloud Coverage | What to Consider |
|---|---|---|---|
| Microsoft Defender for Cloud | CIEM, cloud security posture management, permissions discovery, and risk-based recommendations | Azure, AWS, GCP | Requires paid Defender CSPM. Confirm feature availability, licensing, and remediation capabilities. |
| Delinea PCCE | Dedicated CIEM for entitlement discovery, permissions analysis, risk scoring, and least-privilege enforcement | Azure, AWS, GCP | Microsoft’s designated partner alternative. Evaluate integration, migration effort, functional coverage, and pricing. |
| Microsoft Entra PIM | Just-in-time privileged access, role activation, approvals, and access reviews | Microsoft Entra ID and Azure resource roles | Strong for governing privileged Microsoft roles, but not a standalone multicloud CIEM replacement. |
| Microsoft Entra ID, ID Governance, and Workload ID | Authentication, identity lifecycle governance, and workload identity security | Primarily Microsoft identity environments | Complementary identity controls. Evaluate alongside CIEM capabilities rather than as direct replacements. |
How Can Organizations Manage Cloud Permissions After Entra Permissions Management Retirement?
Managing cloud permissions after Microsoft Entra Permissions Management’s retirement starts with knowing who and what can access your cloud resources, and whether that access is still necessary.
- Review privileged users, service accounts, application identities, and assigned permissions across your cloud environments. Pay particular attention to inactive accounts, excessive privileges, and access to sensitive data or business-critical systems. You can’t reduce risks you don’t know exist.
- Next, assess what your existing security tools already cover. Microsoft Defender for Cloud continues to offer CIEM capabilities through Defender CSPM, but having the right tools doesn’t automatically mean every cloud environment is being monitored.
- Check your visibility across Azure, AWS, and Google Cloud, review security recommendations, and identify any gaps that could leave unnecessary permissions unnoticed.
If those gaps remain, evaluate whether additional capabilities are needed. Dedicated CIEM solutions such as Delinea PCCE can provide more focused entitlement management across multiple cloud environments.
Consider how each option handles human and non-human identities, permissions remediation, licensing, and integration with your existing systems. Just as importantly, establish who is responsible for reviewing access, approving changes, and resolving identified risks.
Finally, translate those findings into outcomes your leadership team can act on.
Instead of overwhelming executives with technical findings, show where exposure has been reduced, what still needs attention, and how effectively your organization is managing cloud access.
Key Metrics to Measure Cloud Permissions Security
| Metric | What to Measure | Business Outcome |
|---|---|---|
| Privileged Access Reviews | Percentage of scheduled access reviews completed | Stronger accountability and access governance |
| Excessive Permissions Remediation | Number and percentage of identified excessive permissions resolved | Reduced unnecessary access and cloud security exposure |
| Identity Monitoring Coverage | Percentage of identified human and non-human identities monitored | Better visibility into cloud access risks |
| Remediation Progress | Time taken to resolve high-priority permissions risks | Faster risk reduction and clearer IT accountability |
| Audit Readiness | Completion of documented reviews and retention of remediation evidence | Stronger support for compliance and cyber insurance discussions |
Need to Reassess Your Microsoft Permissions Management Strategy?
Microsoft Entra Permissions Management may be gone, but the responsibility to protect your cloud environment hasn’t changed.
Understanding your exposure is the first step toward stronger control, less unnecessary access, and measurable risk reduction.
With F12’s Microsoft-first expertise and security-first approach, your internal IT team doesn’t have to navigate those questions alone. Through cloud security posture assessments and co-managed IT support, F12 helps you evaluate prioritize practical improvements that align with the way your organization does business.
Frequently Asked Questions About Microsoft Entra Permissions Management
Is Microsoft Entra Permissions Management Discontinued?
Yes.
Support ended on November 1, and remaining customers were automatically offboarded. That means organizations can no longer rely on the product to monitor cloud entitlements.
Importantly, this retirement did not affect Microsoft Entra ID, Entra ID Governance, or Privileged Identity Management. Microsoft Defender for Cloud also continues to offer CIEM capabilities for managing cloud permissions risk.
What Replaces Microsoft Entra Permissions Management?
There isn’t an identical replacement for Microsoft Entra Permissions Management. Microsoft Defender for Cloud still offers CIEM capabilities through its paid Defender CSPM plan, helping teams identify excessive access across Azure, AWS, and Google Cloud.
Microsoft also named Delinea PCCE as its partner alternative for organizations seeking dedicated CIEM functionality.
Microsoft Entra PIM remains available for just-in-time privileged role access, but doesn’t replace multicloud entitlement analysis. The best fit depends on where your workloads run, which identities need monitoring, and how much visibility and remediation your team requires.
Can Microsoft Entra PIM Replace a Multicloud Permissions Management Solution?
Not on its own. Microsoft Entra PIM helps control elevated access to Microsoft Entra and Azure resources through just-in-time role activation, approvals, time limits, and access reviews.
That’s valuable for reducing standing administrator privileges, but it isn’t the same as CIEM. CIEM examines permissions across cloud environments, including what human and workload identities can access and whether those privileges are excessive.
If your organization operates across Azure, AWS, and Google Cloud, PIM alone won’t provide comprehensive multi-cloud entitlement visibility. Consider Defender for Cloud’s CIEM capabilities or a dedicated solution to address those gaps.
