# microsoft-entra-permissions Source: https://startwithidentity.com/vendors/ciem/microsoft-entra-permissions/ Last updated: 2026-10-16 License: content by Start with Identity. Cite the source URL. --- ## Retirement notice **Microsoft Entra Permissions Management is retired and no longer sold or supported.** Per Microsoft's [end of sale and retirement announcement](https://techcommunity.microsoft.com/blog/microsoft-entra-blog/important-change-announcement-microsoft-entra-permissions-management-end-of-sale/4399382), sales to new Enterprise Agreement and direct customers ended on 1 April 2025 and to new CSP customers on 1 May 2025. End of support was first set for 1 October 2025; a 29 September 2025 update moved it to 1 November 2025, called the extension final, and stated that remaining customers would be auto-offboarded on that date. Microsoft published [offboarding guidance](https://learn.microsoft.com/en-us/previous-versions/entra/permissions-management/how-to-offboard-permissions-management) for the transition. Two features carry on in Microsoft Defender for Cloud as part of the Defender CSPM plan: permissions discovery for high-privileged identities and the Permission Creep Index for multicloud environments. For the rest of the CIEM feature set, Microsoft named [Delinea](https://startwithidentity.com/vendors/pam/delinea/) as its migration partner. We keep this profile as a reference for former customers mapping their requirements to a replacement. ## Overview Microsoft Entra Permissions Management was Microsoft's cloud infrastructure entitlement management ([CIEM](https://startwithidentity.com/guides/fundamentals/what-is-ciem/)) product, built from the 2021 CloudKnox acquisition and folded into the Entra identity family. It provided multi-cloud entitlement visibility across AWS, Azure, and GCP, with the Permission Creep Index as its headline metric for over-provisioning. ## What it was good at The core analysis was solid. It discovered identities, measured granted versus used permissions, and could right-size roles, including on-demand and time-limited permission grants. Living inside Entra was the obvious advantage for Microsoft shops: one identity control plane, familiar tooling, and unified governance alongside the rest of the suite. For Azure-centric estates, it delivered competent CIEM without adding another vendor relationship. Our support and ecosystem score now reflects the end of support rather than Microsoft's reach. ## Where it fell short Product investment felt slower than at independent CIEM specialists, the multi-cloud experience was strongest on Azure and thinner on AWS and GCP, and remediation depth lagged the dedicated vendors. There was no deep just-in-time brokering on par with specialists, and lifecycle provisioning was limited. It read as a capable add-on more than a category leader, and the retirement confirms that Microsoft chose to keep CIEM as a feature of Defender for Cloud rather than a standalone product. ## Pricing No longer available for purchase. While on sale, Microsoft published per-resource, per-month pricing billed through Azure. To budget a replacement, model your estate with the [TCO calculator](https://startwithidentity.com/tools/tco-calculator/). ## Who this profile is for now Existing and former customers planning or completing a migration. If you only used the Permission Creep Index and high-privilege discovery and already run Defender for Cloud, check those features in the Defender CSPM plan first. For full CIEM depth, compare Microsoft's named partner [Delinea](https://startwithidentity.com/vendors/pam/delinea/) with independent options such as [Wiz](https://startwithidentity.com/vendors/ciem/wiz/), [Sonrai Security](https://startwithidentity.com/vendors/ciem/sonrai-security/), [Tenable Cloud Security](https://startwithidentity.com/vendors/ciem/tenable-cloud-security/), or [Britive](https://startwithidentity.com/vendors/ciem/britive/) for just-in-time access brokering. See the full [CIEM category](https://startwithidentity.com/vendors/ciem/). ## Bottom line A retired product. Do not plan a new deployment around it. Former customers should confirm which features they relied on, check what Defender CSPM now covers, and move the remainder to an actively supported CIEM tool.