Microsoft Entra Permissions Management

Overview

Microsoft Entra Permissions Management is Microsoft's cloud infrastructure entitlement management (CIEM) product, built from the 2021 CloudKnox acquisition and folded into the Entra identity family. It provides multi-cloud entitlement visibility across AWS, Azure, and GCP, with the Permission Creep Index as its headline metric for over-provisioning.

What it is good at

The core analysis is solid. It discovers identities, measures granted versus used permissions, and can right-size roles, including on-demand and time-limited permission grants. Living inside Entra is the obvious advantage for Microsoft shops: one identity control plane, familiar tooling, and unified governance alongside the rest of the suite. Support and ecosystem depth are excellent given Microsoft's reach, and pricing transparency is unusually good for the category. For Azure-centric estates, it delivers competent CIEM without adding another vendor relationship.

Where it falls short

The weaknesses are real. Product investment has felt slower than independent CIEM specialists, the multi-cloud experience is strongest on Azure and thinner on AWS and GCP, and remediation depth lags the dedicated vendors. There is no deep just-in-time brokering on par with specialists, and lifecycle provisioning is limited. It reads as a capable add-on more than a category leader, and teams outside the Microsoft stack gain less from the Entra integration that is its main draw.

Pricing

More transparent than most CIEM vendors. Microsoft publishes per-resource, per-month pricing billed through Azure, which makes estimation easier than fully quote-based competitors. Cost still scales with resources monitored, so model your estate with the TCO calculator.

Best for, and who should look elsewhere

Choose Entra Permissions Management when a Microsoft-aligned enterprise wants CIEM inside Entra. For best-of-breed depth, compare Sonrai Security and Wiz, or for active access brokering see Britive and the CIEM category.

Bottom line

A sensible CIEM pick for Microsoft-aligned enterprises wanting entitlement visibility inside Entra, less compelling if you want best-of-breed depth or are not invested in the Microsoft stack.