entra-permissions-management

Microsoft Entra Permissions Management

Microsoft Entra Permissions Management is a Cloud Infrastructure Entitlement Management (CIEM) solution that provides visibility and control over permissions for identities, actions, and resources across Microsoft Azure, AWS, and Google Cloud in a single pane.

When to use

Discovering and reducing excessive, unused, and over-privileged cloud permissions across a multicloud estate, driving toward least privilege. Use this skill when the estate spans multiple clouds; for Azure-only RBAC choice use azure-role-selector.

Map the goal to the right CIEM action

If the goal is...	Use	Notes
Quantify how over-privileged each identity is	Permission Creep Index (PCI)	0-100; > 65 = high risk
Find unused permissions per identity	Activity-based right-sizing report	Compares granted vs used over 90 days
Generate a least-privilege policy from observed activity	Auto-generated policy (right-sizing)	Per identity per cloud
Grant elevated permission temporarily	On-demand permissions request	Approval-based, time-bound
Detect anomalous permission usage	Anomaly detection alerts	First-time-seen action, mass action
Catch over-privileged workload identity	Non-human identity report	Service principals, IAM roles, GCP SAs

Rule of thumb: start with PCI > 65 identities and the non-human identity report. Service principals and machine identities typically hold the largest gap between granted and used permissions and rarely fight back when you right-size them.

Approach

1. Onboard each cloud — Connect Azure subscriptions (single or multiple), AWS accounts (per-account or AWS Organizations), and GCP projects. Permissions Management collects entitlement and activity data via read-only roles. Verify: data collector status = green for each cloud account; activity events flowing within 24 hours.

2. Baseline for 90 days — Don't right-size based on 7 days of activity. Quarterly business cycles (month-end close, audit) need full coverage. Verify: "data collection period" shows ≥ 90 days before remediation work.

3. Sort by PCI - top 20 first — Start with the 20 highest-PCI identities, not the longest list of unused permissions. PCI prioritises by risk (granted breadth + privilege weight), not just count. Verify: top 20 PCI list reduced by ≥ 50 points cumulative after first sprint.

4. Tackle non-human identities first — Service principals, AWS IAM roles, GCP service accounts. They don't complain when you remove unused permissions and they're often the most over-privileged. Verify: non-human identity PCI distribution shifts left (lower) month over month.

5. Right-size with auto-generated policies — Use the activity-based policy generator instead of writing JSON manually. Review the diff, apply to a test workload, then production.

6. Enable on-demand permissions — For high-privilege but rarely-needed permissions, convert standing access to on-demand request flow. Reduces standing risk dramatically.

7. Monitor + alert — Anomaly detection on first-time-seen action and mass actions. Stream alerts to Sentinel for SOC correlation.

Guardrails

• Validate activity baselines cover a representative period (90 days minimum) before aggressively right-sizing. Anything less misses quarterly or month-end-only workflows and causes outages.
• Test in a non-production workload first. A right-sized policy that breaks a CI/CD pipeline at 02:00 is worse than the over-privilege.
• Treat machine/workload identities explicitly - they often hold the largest unused permission gap and rarely fight back when you right-size them. Address them first.
• Coordinate remediation with workload owners. Right-sizing without informing the owner of the service account causes outages and erodes trust in the programme.
• Don't right-size break-glass / emergency access roles. Document the exceptions.
• PCI is a risk score, not a permissions count. Don't compare identities on permission count alone - 5 high-privilege unused beats 50 low-privilege unused.

Common anti-patterns

• "Right-size after 2 weeks of data" - Misses month-end. Outage.
• "Start with the easiest report" - Many small wins, no risk reduction. Sort by PCI.
• "Right-size humans first because there are more of them" - Humans push back; non-humans don't. Non-humans usually carry the highest unused privilege.
• "Apply auto-generated policies directly to production" - Test workload first.
• "Onboard only one cloud at a time over months" - Loses the multicloud visibility that is the entire point. Onboard all clouds in the same sprint.
• "PCI dashboard only - no remediation" - Visibility without action. Track PCI delta monthly as the KPI.

Example prompts

• Onboard our Azure, AWS, and GCP environments to Entra Permissions Management.
• Show the top 20 identities by Permission Creep Index and propose a remediation order.
• Generate a least-privilege policy for our CI/CD service principal based on 90 days of activity.
• Find non-human identities with PCI > 65 and right-size the top 5.
• Set up on-demand permission requests for elevated AWS roles.
• Stream Permissions Management anomaly alerts into Sentinel.

Microsoft Learn

• Overview: https://learn.microsoft.com/entra/permissions-management/overview
• Onboard Azure: https://learn.microsoft.com/entra/permissions-management/onboard-azure
• Onboard AWS: https://learn.microsoft.com/entra/permissions-management/onboard-aws
• Onboard GCP: https://learn.microsoft.com/entra/permissions-management/onboard-gcp
• Permission Creep Index: https://learn.microsoft.com/entra/permissions-management/ui-dashboard
• Right-size permissions: https://learn.microsoft.com/entra/permissions-management/product-permissions-analytics-reports
• Anomaly detection: https://learn.microsoft.com/entra/permissions-management/product-statistical-anomalies