Entra Permissions Management retirement: what does CIEM migration mean?

TL;DR: Unosecur reports that Microsoft will retire Entra Permissions Management on October 1, 2025 and stop new purchases earlier for EA, direct, and CSP customers, while select CIEM capability moves into Defender for Cloud. That shift forces teams to reassess multi-cloud entitlement governance, support continuity, and whether integrated CSPM can replace a standalone CIEM model.

Editorial analysis by NHI Mgmt Group, based on content published by Unosecur: “Entra Permissions Retirement: CIEM Strategy Impact”.

By the numbers:

• No new purchases will be accepted after April 1, 2025 for Enterprise Agreement or direct customers.
• No new purchases will be accepted after May 1, 2025 for Cloud Solution Provider customers.
• The product will no longer be available or supported after October 1, 2025.

Key questions

Q: What breaks when standalone CIEM is retired but cloud permissions still need governance?

A: The main break is control depth, not sign-in capability.

Q: Why does retiring CIEM matter if identity and access management still works?

A: IAM can still function because IAM and CIEM answer different questions.

Q: How should security teams choose between CSPM, DSPM, and CIEM?

A: Start with the control gap you need to close.

Practitioner guidance

• Assess entitlement governance continuity Compare the current CIEM workflow against the successor path and verify that discovery, rightsizing, approvals, and evidence retention still operate at the same depth across Azure, AWS, and GCP.
• Separate authentication from authorization controls Document which controls cover sign-in, which cover cloud entitlements, and where the migration changes the boundary between Entra ID, CIEM, and posture tooling.
• Re-test multi-cloud least-privilege coverage Validate that overprivileged roles, stale access paths, and cloud-specific privilege drift remain visible after the CIEM transition, not only within the security posture console.

Bottom line: The retirement affects entitlement governance across Azure, AWS, and GCP, not the core authentication services in Entra ID.

What's in the full article

Unosecur's full blog covers the operational detail this post intentionally leaves for the source:

• Purchase cut-off dates by customer type and the support timeline that governs the migration window
• The comparison between Defender for Cloud’s integrated CIEM features and a standalone CIEM replacement
• The licensing and subscription changes that affect legacy customers versus new buyers
• The vendor’s guidance on how to preserve multi-cloud entitlement governance after retirement

👉 Read Unosecur's analysis of the Entra Permissions Management retirement and CIEM migration →

Explore further

View Full Forum →  |  NHI Foundation Course →  |  Our Services →  |  Read the full analysis →