Note
Access to this page requires authorization. You can try signing in or changing directories.
Access to this page requires authorization. You can try changing directories.
Microsoft Defender for Cloud provides a cloud infrastructure entitlement management (CIEM) security model. It helps organizations manage and control user access and entitlements in cloud infrastructure. CIEM is a core part of the Cloud Native Application Protection Platform (CNAPP) solution. It shows who or what has access to resources and helps enforce least-privilege access. With CIEM, users and workload identities get only the access they need to do their tasks. CIEM also helps you monitor and manage permissions across Azure, Amazon Web Services (AWS), and Google Cloud Platform (GCP).
Before you start
Before you enable CIEM, make sure you meet the following prerequisites:
Make sure you have the right roles and permissions for each cloud environment to enable the Permissions Management (CIEM) extension in Defender cloud security posture management (Defender CSPM):
- For AWS and GCP, you need the Security Admin role at the account or organization level.
- For Azure, you need the Security Admin role at the subscription level.
Onboard your AWS or GCP environment to Defender for Cloud:
Enable Defender CSPM on your Azure subscription, AWS account, or GCP project.
Enable CIEM for Azure
When you enable the Defender cloud security posture management (Defender CSPM) plan on your Azure account, the Azure CSPM regulatory compliance standard is automatically assigned to your subscription. The Azure CSPM standard provides cloud infrastructure entitlement management (CIEM) recommendations.
When CIEM is disabled, the CIEM recommendations within the Azure CSPM standard aren't calculated.
To enable CIEM for Azure, complete the following steps:
Sign in to the Azure portal.
Search for and select Microsoft Defender for Cloud.
Navigate to Environment settings.
Select the relevant subscription.
Locate the Defender CSPM plan and select Settings.
Enable Permissions Management (CIEM).
Select Continue.
Select Save.
The applicable CIEM recommendations appear on your subscription within a few hours.
List of Azure recommendations:
Azure overprovisioned identities should have only the necessary permissions
Permissions of inactive identities in your Azure subscription should be revoked
Enable CIEM for AWS
When you enable the Defender CSPM plan on your AWS account, the AWS CSPM regulatory compliance standard is automatically assigned to your subscription. The AWS CSPM standard provides CIEM recommendations. When Permissions Management is disabled, the CIEM recommendations in the AWS CSPM standard aren't calculated.
To enable CIEM for AWS, complete the following steps:
Sign in to the Azure portal.
Search for and select Microsoft Defender for Cloud.
Navigate to Environment settings.
Select the relevant AWS account.
Locate the Defender CSPM plan and select Settings.
Enable Permissions Management (CIEM).
Ingest AWS CloudTrail logs to get more accurate CIEM recommendations and insights.
Select Configure access.
Select a deployment method.
Run the CloudFormation deployment script on your AWS environment by using the onscreen instructions.
Check the CloudFormation template has been updated on AWS environment (Stack) checkbox.
Select Review and generate.
Select Update.
The applicable CIEM recommendations appear on your subscription within a few hours.
List of AWS recommendations:
AWS overprovisioned identities should have only the necessary permissions
Permissions of inactive identities in your AWS account should be revoked
Enable CIEM for GCP
When you enable the Defender CSPM plan on your GCP project, the GCP CSPM regulatory compliance standard is automatically assigned to your subscription. The GCP CSPM standard provides CIEM recommendations.
When Permissions Management (CIEM) is disabled, the CIEM recommendations within the GCP CSPM standard aren't calculated.
To enable CIEM for GCP, complete the following steps:
Sign in to the Azure portal.
Search for and select Microsoft Defender for Cloud.
Navigate to Environment settings.
Select the relevant GCP project.
Locate the Defender CSPM plan and select Settings.
Toggle Permissions Management (CIEM) to On.
Ingest GCP cloud logging to ensure your GCP identities are evaluated for permission risks.
Select Save.
Select Next: Configure access.
Select the relevant permissions type.
Select a deployment method.
Run the Cloud Shell or Terraform deployment script on your GCP environment by using the onscreen instructions.
Add a check to the I ran the deployment template for the changes to take effect checkbox.
Select Review and generate.
Select Update.
The applicable CIEM recommendations appear on your subscription within a few hours.
List of GCP recommendations:
GCP overprovisioned identities should have only necessary permissions
Permissions of inactive identities in your GCP project should be revoked
Limitations
Be aware of the following CIEM limitations:
- Serverless and compute identities for AWS are no longer included in CIEM inactivity logic, which can change recommendation counts.
- The Permissions Creep Index (PCI) metric is being deprecated and will no longer appear in Defender for Cloud recommendations.