When I run tenant assessments, one thing comes up again and again. No other tool shows excessive permissions as clearly as the Permission Creep Index in Entra Permissions Management. For many organizations, it was the first time anyone actually saw which identities held which rights across Azure, AWS and GCP. Now Microsoft has made it official. Entra Permissions Management will be retired on October 1, 2025, and as of today new customers can no longer buy it (source). If you've come to depend on EPM's dashboards and reports, this hurts, unless you start working through it methodically now.

Entra Permissions Management stops running for existing tenants on October 1, 2025

Many organizations built their cloud permissions reviews around Entra Permissions Management (EPM), so its end will cause real disruption. Existing tenants can keep using the service until October 1, 2025, but Microsoft won't ship any new features. Support also ends on that date. In a lot of the tenants I work with, people have grown used to the regular permission analyses and the central Permission Creep Index. If you want to keep reporting on these insights, export all relevant findings now and write down how you track least privilege. You'll need that for management reporting and compliance audits in particular.

Practical tip: Export all essential EPM reports and findings by August 2025 and keep them somewhere audit-proof. If the Permission Creep Index has been one of your key KPIs, document its historical trend and the calculation behind it so you can rebuild it later.

Defender for Cloud CSPM, Azure RBAC reviews and PIM remain as Microsoft-native options

Losing EPM doesn't end permissions governance, at least not for Azure. Microsoft Defender for Cloud ships with a strong set of Cloud Security Posture Management features (background) that focus on permissions in Azure subscriptions. It gives you recommendations on exposed roles, inactive privileged accounts and risky assignments. Azure Privileged Identity Management (PIM) and Access Reviews are still good choices for reviewing and enforcing least privilege, though they only cover Azure and Microsoft 365, not AWS or GCP. For many tenants that's enough, because the critical workloads run in Azure anyway. The CSPM recommendations live in the Defender for Cloud portal under "Cloud Security Posture Management" → "Permissions".

Least privilege depends on process more than on tooling

EPM taught people one lesson in particular: a tool is only as good as the process behind it. Least privilege isn't an audit you run once. You have to keep at it. Keep your Access Reviews in Entra ID or Azure PIM going, and in multi-cloud setups you may need manual reviews to close the gap. Every privileged assignment should be time-bound, documented and reviewed on a regular schedule. That only works if someone owns the review cycle and the process is part of how the organization operates, rather than something a tool happens to trigger.

EPM exports your findings and reports as CSV or PDF

You can export reports from the EPM portal directly as CSV or PDF. In practice, these are the exports I'd prioritize:

  • Permission Creep Index (PCI) over time
  • Orphaned permissions overview
  • Privileged identities inventory
  • Permission change history
  • Management summary reports for audits

Put all of it in a secure SharePoint library or a comparable repository. If you plan to keep PCI as a KPI, write down the calculation logic and think about building your own scripts to replicate it. On the Azure side, Azure Resource Graph Explorer works well for taking inventory of role assignments. This simple query lists privileged roles (run it in Azure Resource Graph Explorer):

Resources
| where type == "microsoft.authorization/roleassignments"
| extend principalType = tostring(properties.principalType), roleDefinitionId = tostring(properties.roleDefinitionId)
| where roleDefinitionId in ("<GUIDs of privileged roles>")

Figure: Querying privileged role assignments with Azure Resource Graph

The diagram shows the new CIEM review flow

After EPM is gone, this is what the permissions review workflow looks like in most Azure environments:

flowchart TD
    Assignment["Permission assignment"] --> Review["Regular review (Access Review, PIM)"]
    Review --> Removal["Remove unnecessary rights"]
    Review --> Extension["Extend if justified"]
    Removal --> Audit["Document/Audit"]
    Extension --> Audit

Figure: Permission management process after EPM

Process continuity matters more to me than any single tool

The retirement of Entra Permissions Management is a significant change, but organizations with solid processes won't find it a disaster. If you already run regular Access Reviews, enforce least privilege and keep your documentation up to date, what Defender for Cloud and Entra ID still offer will serve you fine, at least for Azure. The value was always in the discipline, never in one dashboard. Export your key data now and assign clear responsibilities, and your governance will hold up no matter which tools arrive or disappear. If you want to read more about continuous governance and workload identity practices, see my article Workload identities in Entra ID: Managed identities, app registrations and securing your applications.