Pricing

Permafrost prices on identity-object count, not log volume. Every new customer starts with a 30-day free trial of full-coverage CIEM, no card required.

After the trial, coverage continues on the metered Professional Edition: every identity object across all of a customer’s connected tenants, plus every workload surface, API access, and priority support. An administrator can also grant comped access without billing.

A principal is any identity object in a customer’s connected Azure tenants that holds a role assignment. The billing count rolls up to one number per customer, across the set of tenants the customer has connected.

What gets counted:

• Users. Members and guests in the directory who hold any role assignment.
• Service principals. Application service principals provisioned to the directory, counted only when they hold a role assignment.
• Managed identities. System-assigned and user-assigned managed identities with role assignments.
• Agent identities. AI agent and copilot identities with role assignments.

What does not get counted:

• Groups. Groups are containers, not principals. A group never counts toward billing, regardless of how many role assignments or members it holds. Billing counts the human and non-human principals themselves.
• Microsoft first-party service principals (the built-in directory tenants that ship with Azure).
• Identity objects that exist in the directory but hold no role assignments anywhere in the connected tenants.
• Per-tenant doubles — if the same external identity has assignments in two of a customer’s connected tenants, that is two principals because the assignments are independent.

Professional Edition models every identity object inside the customer’s connected tenants, plus the full surface set: Findings, Roles, PIM, custom-role export, API access, and all workload surfaces. The 30-day trial unlocks the same full coverage with no card; after it ends, subscribe to keep full coverage, or have an administrator grant comped access.

The API exposes findings, identities, per-principal UPR, recommended roles, and connected tenants over a scoped, bearer-auth, read-only REST surface. The full route list, scopes, and rate limits are in the API reference.

The full feature breakdown lives in the grid above. The live marketing page is at /pricing.

Most customers self-serve: start the trial, then continue on the metered Professional Edition. Larger programmes can move to Enterprise, a sales-assisted path for teams that need procurement, a security review, and committed volume terms.

Enterprise builds on the same metered model and adds:

• Volume terms. Pricing scales down from the $3.50 per human and $0.50 per non-human list rate, applied to a committed scope.
• Annual commitment. A consolidated annual invoice in place of monthly arrears. Annual prepay takes 20% off the per-identity rate, and the same discount applies to annual overage.
• Procurement and security review. Purchase-order support, a data-processing agreement, and a security questionnaire review.
• Dedicated onboarding. Hands-on onboarding and priority support, plus single sign-on for operator access.

Enterprise is a sales motion, not a self-serve checkout, so there is no Stripe path to it. Start the conversation at Talk to sales.

CIEM measures the gap between permissions granted and permissions used. The unit of work is the identity object, not the log row. Pricing on log volume rewards inflated ingestion and punishes customers who run quiet, well-instrumented tenants. Those are the customers most likely to get value out of a permission-posture tool in the first place. Permafrost prices on the unit it measures.