Microsoft Entra Permissions Management successor

Microsoft retired Microsoft Entra Permissions Management (formerly CloudKnox) on November 1, 2025. New purchases ended on April 1, 2025. Microsoft now directs existing customers to evaluate alternative CIEM solutions. There is no first-party standalone successor.

CloudKnox to MEPM to Permafrost

Microsoft acquired CloudKnox in 2021 and rebranded it Microsoft Entra Permissions Management. MEPM retired on November 1, 2025. Permafrost EPM is the Azure continuation.

Three jobs covered the bulk of MEPM usage in the field.

• Permission discovery. Cross-identity inventory across Azure, and across AWS and GCP for multi-cloud customers. Who has what, where.
• Permissions Creep Index. The 0–100 metric for the gap between permissions granted and permissions used. The number an executive tracked quarterly.
• Permissions on demand. A request-based workflow for time-limited elevated access, typically wired into the customer’s ticketing system.

The goal is use-case parity on Azure, not feature-for-feature parity with the MEPM UI. The shape of the work is what matters.

• Permission discovery. Permafrost inventories every identity in the customer’s connected Azure tenants — users, guests, security groups, service principals, managed identities, AI agent identities — with every role assignment they hold across management groups, subscriptions, resource groups, and individual resources.
• Permission-gap analysis (the UPRS). The Unused Permission Risk Score is the deterministic recovery of the PCI methodology on Azure. Every score points to a specific role assignment, with the ARM activity-log evidence that proves (or fails to prove) usage. The longer treatment lives at /docs/permissions-creep-index.
• Right-sized custom-role generation. Permafrost writes least-privilege custom Azure roles from the permissions an identity actually exercises. Exports land as ARM, Bicep, or Terraform so the role ships through the customer’s change-management process, not a vendor’s.
• Incident timeline with pattern matching. For IR teams, Permafrost lays out the privilege-path patterns an attacker could traverse from a given starting identity. The patterns are the five canonical Permafrost incident classes (P1 through P5), each with a one-sentence customer-facing description.

MEPM was a multi-cloud product. Permafrost covers Microsoft Cloud only — AWS, GCP, and on-premises infrastructure are out of scope.

Migration readers need that constraint up front. Teams that used MEPM exclusively for Azure find Permafrost a clean replacement on permission discovery, gap analysis, and right-sized custom roles. Teams that used MEPM for multi-cloud need a separate path for AWS and GCP, and should plan for two tools rather than one.

Two narrower gaps worth naming:

• Permissions on demand. Permafrost does not ship a request-based elevated-access workflow today. For just-in-time elevation inside a customer’s Azure tenant, Permafrost integrates with the customer’s existing Privileged Identity Management (PIM) setup rather than replacing it.
• Multi-cloud aggregate scoring. PCI rolled every cloud into one number. UPRS is Azure-scoped by design. We do not ship a cross-cloud composite because we do not cover the other clouds, and we will not pretend otherwise.

The path from MEPM to a Permafrost evaluation is read-only end to end. No write-access dependency at any step.

Most teams also evaluate multi-cloud CIEM platforms during this window. Those are credible options if cross-cloud aggregation was the load-bearing MEPM value for your team. If Azure-specific depth and zero-standing-write matter to your evaluation, Permafrost belongs on the shortlist.

1. Connect a tenant. An admin in the customer organization grants read-only OAuth consent on one Azure tenant. Adding more tenants later is a per-tenant repeat of the same flow.
2. Run discovery. The initial pass enumerates identities, role assignments, and recent activity-log evidence. First findings appear the same day. Full UPRS scoring settles over the next measurement window.
3. Compare to your last MEPM PCI report. Run the Permafrost permission-gap report against the identities you tracked in MEPM. The two scoring methodologies line up closely enough that a side-by-side review is direct. The 90-day Professional Edition trial unlocks full coverage so the comparison runs on your real environment.

The retirement window is finite. Teams that have not yet evaluated an Azure CIEM successor are operating with their permission-posture signal degraded. The MEPM dashboards have stopped refreshing. Every week the operational gap between “we used to track this” and “we track this again” widens.

Permafrost closes that gap without standing write access to your tenants and without a multi-month deployment project. The 90-day Trial is shaped for exactly this evaluation: connect a tenant, compare against your last MEPM report, decide.