| name | entra-permissions-management |
| description | Guidance for Microsoft Entra Permissions Management (CIEM) — discovers, right-sizes, and monitors permissions across Microsoft Azure, AWS, and Google Cloud. Covers cloud onboarding, the Permission Creep Index (PCI), generating least-privilege policies from observed activity, on-demand permission grants, and workload identity coverage. WHEN: Entra Permissions Management, CIEM, multicloud permissions, Permission Creep Index, PCI, right-size permissions, unused permissions, least privilege across AWS GCP Azure, cloud entitlement management, over-privileged workload identity, IAM right-sizing, multicloud IAM posture. DO NOT USE for Azure-only RBAC role choice (use azure-role-selector) or Defender for Cloud security posture (use defender-for-cloud-hardening). |
| license | MIT |
| metadata | {"author":"Microsoft","version":"0.1.0"} |
Microsoft Entra Permissions Management
Microsoft Entra Permissions Management is a Cloud Infrastructure Entitlement Management (CIEM)
solution that provides visibility and control over permissions for identities, actions, and
resources across Microsoft Azure, AWS, and Google Cloud in a single pane.
When to use
Discovering and reducing excessive, unused, and over-privileged cloud permissions across a
multicloud estate, driving toward least privilege. Use this skill when the estate spans
multiple clouds; for Azure-only RBAC choice use azure-role-selector.
Map the goal to the right CIEM action
| If the goal is... | Use | Notes |
|---|
| Quantify how over-privileged each identity is | Permission Creep Index (PCI) | 0-100; > 65 = high risk |
| Find unused permissions per identity | Activity-based right-sizing report | Compares granted vs used over 90 days |
| Generate a least-privilege policy from observed activity | Auto-generated policy (right-sizing) | Per identity per cloud |
| Grant elevated permission temporarily | On-demand permissions request | Approval-based, time-bound |
| Detect anomalous permission usage | Anomaly detection alerts | First-time-seen action, mass action |
| Catch over-privileged workload identity | Non-human identity report | Service principals, IAM roles, GCP SAs |
Rule of thumb: start with PCI > 65 identities and the non-human identity report.
Service principals and machine identities typically hold the largest gap between granted
and used permissions and rarely fight back when you right-size them.
Approach
-
Onboard each cloud — Connect Azure subscriptions (single or multiple), AWS accounts
(per-account or AWS Organizations), and GCP projects. Permissions Management collects
entitlement and activity data via read-only roles.
Verify: data collector status = green for each cloud account; activity events flowing
within 24 hours.
-
Baseline for 90 days — Don't right-size based on 7 days of activity. Quarterly business
cycles (month-end close, audit) need full coverage.
Verify: "data collection period" shows ≥ 90 days before remediation work.
-
Sort by PCI - top 20 first — Start with the 20 highest-PCI identities, not the longest
list of unused permissions. PCI prioritises by risk (granted breadth + privilege weight),
not just count.
Verify: top 20 PCI list reduced by ≥ 50 points cumulative after first sprint.
-
Tackle non-human identities first — Service principals, AWS IAM roles, GCP service
accounts. They don't complain when you remove unused permissions and they're often the
most over-privileged.
Verify: non-human identity PCI distribution shifts left (lower) month over month.
-
Right-size with auto-generated policies — Use the activity-based policy generator
instead of writing JSON manually. Review the diff, apply to a test workload, then
production.
-
Enable on-demand permissions — For high-privilege but rarely-needed permissions,
convert standing access to on-demand request flow. Reduces standing risk dramatically.
-
Monitor + alert — Anomaly detection on first-time-seen action and mass actions.
Stream alerts to Sentinel for SOC correlation.
Guardrails
- Validate activity baselines cover a representative period (90 days minimum) before
aggressively right-sizing. Anything less misses quarterly or month-end-only workflows
and causes outages.
- Test in a non-production workload first. A right-sized policy that breaks a CI/CD
pipeline at 02:00 is worse than the over-privilege.
- Treat machine/workload identities explicitly - they often hold the largest unused
permission gap and rarely fight back when you right-size them. Address them first.
- Coordinate remediation with workload owners. Right-sizing without informing the owner
of the service account causes outages and erodes trust in the programme.
- Don't right-size break-glass / emergency access roles. Document the exceptions.
- PCI is a risk score, not a permissions count. Don't compare identities on permission
count alone - 5 high-privilege unused beats 50 low-privilege unused.
Common anti-patterns
- "Right-size after 2 weeks of data" - Misses month-end. Outage.
- "Start with the easiest report" - Many small wins, no risk reduction. Sort by PCI.
- "Right-size humans first because there are more of them" - Humans push back; non-humans
don't. Non-humans usually carry the highest unused privilege.
- "Apply auto-generated policies directly to production" - Test workload first.
- "Onboard only one cloud at a time over months" - Loses the multicloud visibility that
is the entire point. Onboard all clouds in the same sprint.
- "PCI dashboard only - no remediation" - Visibility without action. Track PCI delta
monthly as the KPI.
Example prompts
Onboard our Azure, AWS, and GCP environments to Entra Permissions Management.Show the top 20 identities by Permission Creep Index and propose a remediation order.Generate a least-privilege policy for our CI/CD service principal based on 90 days of activity.Find non-human identities with PCI > 65 and right-size the top 5.Set up on-demand permission requests for elevated AWS roles.Stream Permissions Management anomaly alerts into Sentinel.
Microsoft Learn
