Microsoft Entra Permissions Management

Enterprise IT is shifting toward dynamic multi-cloud and multi-hybrid architectures to support fully digital operations, faster application delivery, and rapidly changing market conditions. Agile teams increasingly depend on clouds to execute workloads on a just-in-time basis, while networks have become more open to employees, partners, suppliers, and customers. As automation grows, workload identities (applications, containers, scripts) gain broader access to cloud resources, making permissions sprawl a central risk—especially since many identities use only a small fraction of the permissions they are granted, leaving excess and undocumented access outside traditional IAM visibility.

This volatility pressures conventional role-based IGA, IAM, and PAM approaches that were built for more static environments. In response, the DREAM (Dynamic Resource Entitlement & Access Management) classification defines platforms that operate at cloud speed, using task-, toolchain-, and workload-based permissions rather than static roles. DREAM includes CIEM tools and newer PAM-for-DevOps capabilities, covering protection of cloud infrastructure, cloud assets, and critical on-prem components needed for cloud connectivity.

Microsoft Entra Permissions Management is positioned as a CIEM platform aligned to DREAM principles, emphasizing analysis of historical usage to right-size access, enable just-in-time elevation, and continuously monitor entitlements across Azure, AWS, and GCP. It discovers identities and permissions via automated scanning, highlights unused entitlements, and calculates a Permissions Creep Index that refreshes hourly. Deployment requires Azure AD sign-in (not Azure), supports self-service temporary permissions, can delete permissions unused for over 90 days, and provides customizable forensic reporting. Strengths include rapid onboarding, clear UX, and strong analytics; challenges include limited cloud breadth, lack of hybrid/sovereign cloud support, missing ITSM integrations, and resource-based pricing.

• 90% of identities use less than 5% of the permissions granted.
• Microsoft Entra Permissions Management provides visibility and control over permissions for identities and resources in Azure, AWS, and GCP.
• Azure Active Directory sign-in is required to deploy Microsoft Entra Permissions Management, but Azure itself is not required.
• Identities and attached permissions are discovered by automated scanning that identifies used versus unused permissions.
• The platform computes a Permissions Creep Index to assess risk from unused or excess permissions and the gap between granted and used access.
• The analytics engine refreshes the Permissions Creep Index every hour after installation.
• Permissions unused for more than 90 days can be automatically deleted.
• Reports are available out of the box, are customizable, and can be scheduled or generated on demand and distributed by email.
• Microsoft acquired CloudKnox in 2021 and evolved it into Microsoft Entra Permissions Management.
• The product is priced at $125 per resource per year and includes a free 90-day trial.

• “A dynamic multi-cloud, multi-hybrid IT architecture is coming to dominate enterprise networks.”
• “What was once considered ‘privileged’ is becoming the norm as collaboration and data sharing become ubiquitous.”
• “It is not about setting up a server on a physical machine that runs for years anymore, but about constantly changing workloads.”
• “DREAM platforms must operate at the speed of the cloud with permissions based on tasks, toolchains and workloads rather than roles.”
• “A primary capability of an effective CIEM platform is full discovery and onboarding of identities and attached permissions in the cloud.”
• “This informs a key part of the platform; the Permissions Creep Index.”
• “Only authorized business cloud accounts can be found so rogue cloud instances set up by individuals or teams will be missed by the platform.”
• “A human identity can also request access on behalf of a workload identity which is a neat and forward-thinking capability.”
• “Flexibility is built into the platform and brings elements of traditional PAM elevation but at a more dynamic rate.”
• “Overall, however, this product will undoubtedly have an impact on the burgeoning CIEM market given its rapid deployment, logical UX, strong analytics capabilities and cloud native support out of the box.”