Cloud Renames Contribute
Deprecated → MigratedCompute, Security & InfraAzure

CloudKnox Permissions Management Microsoft Defender for Cloud CIEM (Entra Permissions Management Retirement)

Legacy names CloudKnox Permissions Management, Microsoft Entra Permissions Management

Cloud infrastructure entitlement management (CIEM) capabilities for discovering, analyzing, and right-sizing overprivileged human and workload identities across Azure, AWS, and GCP.

Open in interactive timeline ↗All Azure renamesHome

Naming timeline

  1. CloudKnox Permissions Management

    · Microsoft Acquisition of CloudKnox Security

    Acquired by Microsoft to provide multi-cloud Permission Creep Index (PCI) and entitlement visibility across Azure, AWS, and GCP.

  2. Microsoft Entra Permissions Management

    · General Availability under Microsoft Entra

    Launched as a standalone product in the Microsoft Entra family when Microsoft Entra was introduced.

  3. Microsoft Defender for Cloud CIEM (Entra Permissions Management Retirement)Current name

    · Standalone Retirement & Consolidation into Defender CSPM

    Standalone Microsoft Entra Permissions Management ended sales on April 1, 2025 and retired in October–November 2025, with integrated CIEM capabilities delivered via Microsoft Defender for Cloud CSPM.

What replaced CloudKnox Permissions Management?

CloudKnox Permissions Management has been superseded by Microsoft Defender for Cloud CIEM (Entra Permissions Management Retirement), with the latest change on 1 November 2025 (Standalone Retirement & Consolidation into Defender CSPM). Earlier names covered by this entry also include Microsoft Entra Permissions Management. Cloud infrastructure entitlement management (CIEM) capabilities for discovering, analyzing, and right-sizing overprivileged human and workload identities across Azure, AWS, and GCP. The underlying legacy API or CLI surface is deprecated, so a technical migration is required.

Also known as

  • CloudKnox Security
  • Entra Permissions Management (MEPM)
  • Defender CSPM CIEM

Technical identifiers

Legacy identifiers deprecated. The underlying API or CLI surface for the legacy name is officially deprecated, so this change requires a technical migration rather than a label update.

ARM Resource Providers (Microsoft.*)Microsoft.Security/pricings Microsoft.Authorization/roleAssignments graph.microsoft.com/beta/identityGovernance/permissionsAnalytics (retired)
Azure CLI (az) / PowerShellaz security pricing create --name CloudPosture
Entra ID / Azure RBAC RolesSecurity Admin Security Reader Permissions Management Administrator (retired)
Terraform Resources (azurerm_*)azurerm_security_center_subscription_pricing

Standalone Microsoft Entra Permissions Management is retired; multi-cloud CIEM posture and permission risk insights are now managed through Microsoft Defender for Cloud (Microsoft.Security CloudPosture).

Notes & disambiguation

  • Following Microsoft's acquisition of CloudKnox Security on July 21, 2021, the multi-cloud CIEM platform was rebranded and launched as Microsoft Entra Permissions Management in July 2022.
  • In April 2025, Microsoft announced the end of sale (effective April 1, 2025) and full retirement (effective October–November 2025) of standalone Microsoft Entra Permissions Management.
  • Core Cloud Infrastructure Entitlement Management (CIEM) risk analysis, effective permissions discovery, and attack path correlation are consolidated natively into Microsoft Defender for Cloud (under the Defender Cloud Security Posture Management [CSPM] plan), while Microsoft partnered with Delinea for standalone multi-cloud CIEM.

Sources & official documentation

Catalog last updated . Spotted an error? Suggest an edit