Topic starter
25/06/2026 1:40 pm
TL;DR: Microsoft’s retirement of Entra Permissions Management leaves a CIEM gap across Azure, AWS, and Google Cloud, with SailPoint positioning its CIEM offering as the replacement path for visibility, least-privilege enforcement, and review workflows. The real issue is not product substitution but whether cloud entitlement governance is mature enough to survive a platform exit without losing control of privilege creep.
Editorial analysis by NHI Mgmt Group, based on content published by SailPoint: “Microsoft ends Entra Permissions Management: Why SailPoint CIEM is your next move”.
Key questions
Q: What breaks when a CIEM platform is retired in a multi-cloud environment?
A: The main failure is the loss of a dedicated entitlement governance layer.
Q: Why does cloud entitlement sprawl create risk even when teams have access visibility?
A: Visibility alone does not reduce risk if it is not connected to certification and revocation.
Q: How should IAM teams respond when a cloud access control tool is being retired?
A: They should identify every workflow that depends on the tool, then decide whether those controls move into a new CIEM platform, an IAM process, or a manual governance model.
Practitioner guidance
- Map cloud entitlement dependencies Inventory where Azure, AWS and Google Cloud access reviews, right-sizing and remediation currently depend on Entra Permissions Management or a similar CIEM layer.
- Recheck overprovisioned access paths Review cloud roles, inherited permissions and exception accounts for access that has outlived the current job function or business need.
- Tie discovery to revocation workflows Ensure entitlement visibility feeds certification and removal workflows so cloud access is not only identified but actually reduced when it is unjustified.
Bottom line: The article shows that retiring a CIEM tool can expose weak cloud entitlement governance rather than simply creating a replacement decision.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
25/06/2026 3:40 pm
CIEM is now an operating requirement, not a procurement category. When a major platform retires an entitlement-management capability, the underlying governance burden does not shrink. It becomes the customer’s problem to preserve visibility, review discipline and revocation across multi-cloud estates. The practitioner conclusion is that CIEM must be treated as a durable control plane, not a replaceable add-on.
A few things that frame the scale:
- Over 70% of organisations lack automated access risk analysis, user access reviews and provisioning and deprovisioning, according to Pathlock's 2025 Digital Transformation and Access Risk Report.
A question worth separating out:
Q: What is the difference between CIEM and broader IAM governance?
A: CIEM focuses on cloud entitlements, permissions and effective access across cloud platforms, while broader IAM governance covers identity lifecycle, authentication, role management and access policy across the enterprise. CIEM is one control layer inside a wider governance model, not a substitute for IAM or IGA.
👉 Read our full editorial: Entra Permissions Management retirement raises the bar for ciem