Entra Permissions Management Retirement: clean up leftovers and rebuild CIEM coverage

Microsoft Entra Permissions Management was retired on 1 November 2025, and organisations that used it lost their cross-cloud entitlement analytics, their Permission Creep Index history and their automated right-sizing in one step, while the roles and OIDC applications it created in AWS, Azure and Google Cloud may still be sitting in place. A year on, two jobs remain for many teams: finish the offboarding so no orphaned high-read access is left behind, and replace the CIEM coverage with something that actually drives least privilege. This guide gives the official timeline, what was lost, how to find leftover artefacts, the replacement options (Microsoft Defender for Cloud CIEM, cloud-native tools and third-party CIEM) and how to measure that the replacement works. It is for cloud security, identity and platform teams. Clouds are listed alphabetically. CIEM as a discipline is covered in the Cloud PAM and CIEM Guide; this page is about the transition.

This is an independent guide from NHI Mgmt Group, based on Microsoft's public documentation as of November 2026. It is not sponsored or reviewed by Microsoft. Product features change, so confirm settings against Microsoft's current documentation.

Key takeaways

• The product is gone and so is its data. Microsoft auto-offboarded customers on 1 November 2025, and its offboarding page states that deleting data collectors ends access to historic data. Anything not exported or recorded before then cannot be recovered.
• Offboarding leaves artefacts unless done by hand. Roles and permissions granted during onboarding in each cloud, the OIDC applications for AWS and Google Cloud, and the CIEM enterprise application in Entra ID all need explicit removal or disabling.
• Defender for Cloud covers part of the gap. CIEM in the Defender CSPM plan flags overprovisioned and inactive identities across Azure, AWS and Google Cloud, but Microsoft now marks the Permission Creep Index as being deprecated there too.
• Cloud-native tools fill in the detail. AWS IAM last accessed information and Google Cloud IAM role recommendations are the sources Microsoft itself points to for unused action detail.
• Measure outcomes, not scores. Replace PCI with metrics you can reproduce: unused permissions removed, inactive identities revoked, standing privileged assignments converted to just-in-time.

What is changing and why

Entra Permissions Management was Microsoft's standalone CIEM product. According to Microsoft Learn it offered cross-cloud permissions discovery for AWS, Azure and Google Cloud, the Permission Creep Index (PCI, an aggregated metric of the risk from unused or excessive permissions), permission usage analytics, automated deletion of permissions unused for 90 days, permissions on demand (time-limited grants), machine learning anomaly detection and forensic reports. Microsoft's announcement cited a review of its innovation portfolio and a decision to partner with the ecosystem for adjacent capabilities, naming a third-party CIEM partner for customers who need extended functionality, and committed to keep some CIEM capability in Microsoft Defender for Cloud.

Official timeline and current status

Dates as stated in Microsoft's own announcement and Learn pages, checked on 8 November 2026. The offboarding page body still shows the earlier 1 October 2025 date in places; Microsoft's announcement update of 29 September 2025 and the page banner give 1 November 2025 as final.

Who and what is affected

• Former paying customers: lost reports, PCI trends, alerts and any permissions on demand workflows. Access requests that relied on on-demand grants need a new route.
• Auditors and risk owners: evidence of periodic entitlement review (NIST SP 800-53 AC-6(7), ISO/IEC 27001:2022 A.5.18) that came from the product needs a new source.
• Cloud accounts that were onboarded: each holds read roles and, for AWS and Google Cloud, an OIDC trust to an Entra application. Automatic offboarding deleted Microsoft's data collection; Microsoft's documented steps to remove what you granted in each cloud are manual.
• Trial users who never offboarded: the same artefacts, often with no owner, because the trial was abandoned.

Finding affected systems and identities

Treat every leftover artefact as a non-human identity with an owner of "nobody". Search, record, then remove.

Microsoft's offboarding sequence is: remove roles and permissions assigned during onboarding in each cloud; delete the OIDC application for AWS and Google Cloud; delete the data collectors; then set "Enabled for users to sign-in?" to No on the Cloud Infrastructure Entitlement Management enterprise application. Deleting the apps requires the Permissions Management Administrator and Cloud Application Administrator roles. After retirement the portal may not be usable, so work directly in each cloud and in Entra ID. Removing a stale cross-cloud trust is the same task as any orphaned federation: see the How to audit AWS IAM Roles Anywhere and OIDC identity providers and the How to find and remove stale service principals in Entra ID.

Migration options

Option 1: Microsoft Defender for Cloud CIEM

• What it is: the "Permissions Management (CIEM)" extension in the Defender CSPM plan, enabled per Azure subscription, AWS account or Google Cloud project by a user with the Security Admin role.
• Coverage: Entra users, groups and service principals; AWS IAM users, roles and groups; Google Cloud users, groups and service accounts.
• Recommendations: per cloud, "overprovisioned identities should have only the necessary permissions" and "permissions of inactive identities ... should be revoked", appearing within a few hours of enablement.
• Onboarding: AWS uses a CloudFormation stack and benefits from CloudTrail ingestion; Google Cloud uses Cloud Shell or Terraform and needs cloud logging ingested.
• Limits stated by Microsoft: PCI is being deprecated; AWS serverless and compute identities are excluded from inactivity logic; since 6 August 2026 the unused action detail for AWS and Google Cloud is no longer listed.

Option 2: Cloud-native tools

See the IAM Access Analyzer Guide, the Privileged Identity Management (PIM) Guide and the Google Cloud IAM and Service Accounts Guide.

Option 3: Third-party CIEM

Standalone CIEM products and CNAPP platforms with CIEM modules restore a single cross-cloud view, normalised permission analytics and automated remediation. They also require their own read access to every account, which recreates the trust footprint you just cleaned up, so scope it deliberately. Use the CIEM Buyers Guide for evaluation criteria.

Choosing

• Mostly Azure, already on Defender CSPM: enable Defender CIEM, add PIM for privileged roles, and use cloud-native tools for detail in AWS and Google Cloud.
• Balanced multicloud estate with many machine identities: a dedicated CIEM or CNAPP module is more likely to give action-level analytics across clouds and automated right-sizing.
• Small estate: native tools plus a quarterly scripted review can be enough; document the review as the AC-6(7) evidence.

Testing and rollback

1. Remove leftover trust first, in a non-production account: delete the collector role, confirm via CloudTrail, Azure activity log or Cloud Audit Logs that nothing else assumed it for 30 days, then repeat in production.
2. Disable before delete in Entra ID: set the CIEM enterprise application to not allow sign-in, watch sign-in logs for a cycle, then delete the app registrations. Re-enabling is the rollback.
3. Enable the replacement in one account per cloud, compare its findings with any exported Permissions Management reports, and tune before rolling out.
4. Remediate in review mode: apply right-sizing through infrastructure as code pull requests so each removal is reviewable and revertible.
5. Protect break-glass identities: exclude documented emergency accounts from automated revocation and review them separately.

Measurement

• Leftover Permissions Management artefacts (roles, OIDC providers, workload identity pools, service principals): target zero.
• Percentage of identities flagged overprovisioned, trending down quarter on quarter.
• Inactive identities with active permissions, and median days to revoke once flagged.
• Standing privileged assignments versus eligible (just-in-time) assignments.
• Percentage of accounts, subscriptions and projects covered by the replacement tool.

Risks of doing nothing

• Orphaned cross-cloud trust: a role trusting an Entra application nobody owns is an unmonitored path into every onboarded account. Adding or abusing cloud roles is ATT&CK T1098.003 Additional Cloud Roles, and valid cloud account abuse is T1078.004.
• Silent permission creep: without usage analytics, permissions granted for projects and incidents accumulate, especially on service principals, roles and service accounts that no one reviews.
• Audit gaps: entitlement review evidence that previously came from one product is missing for the period since November 2025.
• Unsupported dependencies: scripts and dashboards that called the retired API fail quietly. NIST SP 800-53 SA-22 expects unsupported components to be replaced or removed.

Common failure patterns

• Assuming automatic offboarding removed everything, when Microsoft's documented cloud-side clean-up is manual.
• Deleting the Entra application but leaving the AWS OIDC provider or Google Cloud workload identity pool that trusted it.
• Turning on a replacement tool and treating its recommendation count as the metric, without assigning owners to remediate.
• Rebuilding PCI-style dashboards on a metric Microsoft has marked as being deprecated.
• Granting the new CIEM tool broad write permissions for auto-remediation before review mode has been proven.

Framework mapping

Practitioner checklist

• Confirm whether any tenant ever onboarded Entra Permissions Management, including trials.
• List and remove collector roles, OIDC providers, workload identity pools and role assignments in AWS, Azure and Google Cloud.
• Disable, then delete, the Cloud Infrastructure Entitlement Management enterprise application and per-cloud OIDC app registrations.
• Remove scripts, dashboards and runbooks that called the retired product.
• Choose a replacement: Defender for Cloud CIEM, cloud-native tools, third-party CIEM, or a combination, documenting the rationale.
• Enable CloudTrail and Google Cloud logging ingestion so usage-based recommendations are accurate.
• Move privileged Azure roles to PIM eligible assignments and apply equivalent just-in-time patterns in other clouds.
• Replace PCI with reproducible metrics and report them quarterly as entitlement review evidence.

Standards and references

• Microsoft Learn: Offboard Microsoft Entra Permissions Management
• Microsoft Entra Blog: Entra Permissions Management end of sale and retirement announcement
• Microsoft Learn: Permissions management (CIEM) in Microsoft Defender for Cloud
• Microsoft Learn: Enable Permissions Management (CIEM) in Defender for Cloud
• AWS: Refine permissions using last accessed information
• Google Cloud: Role recommendations overview
• NIST: SP 800-53 Rev 5 Security and Privacy Controls

Related NHI Mgmt Group resources: Cloud PAM and CIEM Guide · CIEM Buyers Guide · Least Privilege Techniques Guide · Orphaned and Dormant Accounts · CNAPP Guide