entra-permissions-management

Name: entra-permissions-management
Author: vinayaklatthe

161stars34forks

How to install entra-permissions-management?

vinayaklatthe/microsoft-security-skills/entra-permissions-management

$npx -y skills add vinayaklatthe/microsoft-security-skills --skill entra-permissions-management

Installs into the current project.

Summary

Guidance for Microsoft Entra Permissions Management (CIEM) — discovers, right-sizes, and monitors permissions across Microsoft Azure, AWS, and Google Cloud. Covers cloud onboarding, the Permission Creep Index (PCI), generating least-privilege policies from observed activity, on-d

Files · 1

View on GitHub

SKILL.md

1	# Microsoft Entra Permissions Management
2
3	Microsoft Entra Permissions Management is a Cloud Infrastructure Entitlement Management (CIEM)
4	solution that provides visibility and control over permissions for identities, actions, and
5	resources across Microsoft Azure, AWS, and Google Cloud in a single pane.
6
7	## When to use
8	Discovering and reducing excessive, unused, and over-privileged cloud permissions across a
9	multicloud estate, driving toward least privilege. Use this skill when the estate spans
10	multiple clouds; for Azure-only RBAC choice use `azure-role-selector`.
11
12	## Map the goal to the right CIEM action
13
14	\| If the goal is... \| Use \| Notes \|
15	\|---\|---\|---\|
16	\| Quantify how over-privileged each identity is \| Permission Creep Index (PCI) \| 0-100; > 65 = high risk \|
17	\| Find unused permissions per identity \| Activity-based right-sizing report \| Compares granted vs used over 90 days \|
18	\| Generate a least-privilege policy from observed activity \| Auto-generated policy (right-sizing) \| Per identity per cloud \|
19	\| Grant elevated permission temporarily \| On-demand permissions request \| Approval-based, time-bound \|
20	\| Detect anomalous permission usage \| Anomaly detection alerts \| First-time-seen action, mass action \|
21	\| Catch over-privileged workload identity \| Non-human identity report \| Service principals, IAM roles, GCP SAs \|
22
23	> Rule of thumb: start with PCI > 65 identities and the non-human identity report.
24	> Service principals and machine identities typically hold the largest gap between granted
25	> and used permissions and rarely fight back when you right-size them.
26
27	## Approach
28
29	1. Onboard each cloud — Connect Azure subscriptions (single or multiple), AWS accounts
30	(per-account or AWS Organizations), and GCP projects. Permissions Management collects
31	entitlement and activity data via read-only roles.
32	*Verify: data collector status = green for each cloud account; activity events flowing
33	within 24 hours.*
34
35	2. Baseline for 90 days — Don't right-size based on 7 days of activity. Quarterly business
36	cycles (month-end close, audit) need full coverage.
37	Verify: "data collection period" shows ≥ 90 days before remediation work.
38
39	3. Sort by PCI - top 20 first — Start with the 20 highest-PCI identities, not the longest
40	list of unused permissions. PCI prioritises by risk (granted breadth + privilege weight),
41	not just count.
42	Verify: top 20 PCI list reduced by ≥ 50 points cumulative after first sprint.
43
44	4. Tackle non-human identities first — Service principals, AWS IAM roles, GCP service
45	accounts. They don't complain when you remove unused permissions and they're often the
46	most over-privileged.
47	Verify: non-human identity PCI distribution shifts left (lower) month over month.
48
49	5. Right-size with auto-generated policies — Use the activity-based policy generator
50	instead of writing JSON manually. Review the diff, apply to a test workload, then
51	production.
52
53	6. Enable on-demand permissions — For high-privilege but rarely-needed permissions,
54	convert standing access to on-demand request flow. Reduces standing risk dramatically.
55
56	7. Monitor + alert — Anomaly detection on first-time-seen action and mass actions.
57	Stream alerts to Sentinel for SOC correlation.
58
59	## Guardrails
60	- **Validate activity baselines cover a representative period (90 days minimum) before
61	aggressively right-sizing.** Anything less misses quarterly or month-end-only workflows
62	and causes outages.
63	- Test in a non-production workload first. A right-sized policy that breaks a CI/CD
64	pipeline at 02:00 is worse than the over-privilege.
65	- **Treat machine/workload identities explicitly - they often hold the largest unused
66	permission gap and rarely fight back when you right-size them.** Address them first.
67	- Coordinate remediation with workload owners. Right-sizing without informing the owner
68	of the service account causes outages and erodes trust in the programme.
69	- Don't right-size break-glass / emergency access roles. Document the exceptions.
70	- **PCI is a risk score, not a permissio

People who liked this also viewed

6 picks

Type

entra-permissions-management

161stars34forks

View on GitHub

How to install entra-permissions-management?

vinayaklatthe/microsoft-security-skills/entra-permissions-management

$npx -y skills add vinayaklatthe/microsoft-security-skills --skill entra-permissions-management

Installs into the current project.

Summary

Files · 1

View on GitHub

SKILL.md

1	# Microsoft Entra Permissions Management
2
3	Microsoft Entra Permissions Management is a Cloud Infrastructure Entitlement Management (CIEM)
4	solution that provides visibility and control over permissions for identities, actions, and
5	resources across Microsoft Azure, AWS, and Google Cloud in a single pane.
6
7	## When to use
8	Discovering and reducing excessive, unused, and over-privileged cloud permissions across a
9	multicloud estate, driving toward least privilege. Use this skill when the estate spans
10	multiple clouds; for Azure-only RBAC choice use `azure-role-selector`.
11
12	## Map the goal to the right CIEM action
13
14	\| If the goal is... \| Use \| Notes \|
15	\|---\|---\|---\|
16	\| Quantify how over-privileged each identity is \| Permission Creep Index (PCI) \| 0-100; > 65 = high risk \|
17	\| Find unused permissions per identity \| Activity-based right-sizing report \| Compares granted vs used over 90 days \|
18	\| Generate a least-privilege policy from observed activity \| Auto-generated policy (right-sizing) \| Per identity per cloud \|
19	\| Grant elevated permission temporarily \| On-demand permissions request \| Approval-based, time-bound \|
20	\| Detect anomalous permission usage \| Anomaly detection alerts \| First-time-seen action, mass action \|
21	\| Catch over-privileged workload identity \| Non-human identity report \| Service principals, IAM roles, GCP SAs \|
22
23	> Rule of thumb: start with PCI > 65 identities and the non-human identity report.
24	> Service principals and machine identities typically hold the largest gap between granted
25	> and used permissions and rarely fight back when you right-size them.
26
27	## Approach
28
29	1. Onboard each cloud — Connect Azure subscriptions (single or multiple), AWS accounts
30	(per-account or AWS Organizations), and GCP projects. Permissions Management collects
31	entitlement and activity data via read-only roles.
32	*Verify: data collector status = green for each cloud account; activity events flowing
33	within 24 hours.*
34
35	2. Baseline for 90 days — Don't right-size based on 7 days of activity. Quarterly business
36	cycles (month-end close, audit) need full coverage.
37	Verify: "data collection period" shows ≥ 90 days before remediation work.
38
39	3. Sort by PCI - top 20 first — Start with the 20 highest-PCI identities, not the longest
40	list of unused permissions. PCI prioritises by risk (granted breadth + privilege weight),
41	not just count.
42	Verify: top 20 PCI list reduced by ≥ 50 points cumulative after first sprint.
43
44	4. Tackle non-human identities first — Service principals, AWS IAM roles, GCP service
45	accounts. They don't complain when you remove unused permissions and they're often the
46	most over-privileged.
47	Verify: non-human identity PCI distribution shifts left (lower) month over month.
48
49	5. Right-size with auto-generated policies — Use the activity-based policy generator
50	instead of writing JSON manually. Review the diff, apply to a test workload, then
51	production.
52
53	6. Enable on-demand permissions — For high-privilege but rarely-needed permissions,
54	convert standing access to on-demand request flow. Reduces standing risk dramatically.
55
56	7. Monitor + alert — Anomaly detection on first-time-seen action and mass actions.
57	Stream alerts to Sentinel for SOC correlation.
58
59	## Guardrails
60	- **Validate activity baselines cover a representative period (90 days minimum) before
61	aggressively right-sizing.** Anything less misses quarterly or month-end-only workflows
62	and causes outages.
63	- Test in a non-production workload first. A right-sized policy that breaks a CI/CD
64	pipeline at 02:00 is worse than the over-privilege.
65	- **Treat machine/workload identities explicitly - they often hold the largest unused
66	permission gap and rarely fight back when you right-size them.** Address them first.
67	- Coordinate remediation with workload owners. Right-sizing without informing the owner
68	of the service account causes outages and erodes trust in the programme.
69	- Don't right-size break-glass / emergency access roles. Document the exceptions.
70	- **PCI is a risk score, not a permissio

People who liked this also viewed

6 picks

Type