What is CIEM?

An entitlement is a permission an identity holds: a user, a group, a service account, an application or a role. CIEM collects those grants, collects usage data, and shows the gap between granted and used access. The result is a list of identities that could be given less without anyone noticing.

What the clouds provide natively

• AWS: IAM Access Analyzer has unused access analyzers that report unused roles, unused access keys and unused passwords, and unused services and actions for active roles. It can also list resources shared with external principals and generate a policy based on CloudTrail activity.
• Google Cloud: the IAM recommender compares a principal's permissions with those used in the last 90 days and suggests removing or replacing a role. It does not apply its suggestions automatically; an administrator reviews each one.
• Azure: Azure role-based access control assigns roles at management group, subscription, resource group or resource scope. Microsoft Entra Privileged Identity Management makes privileged roles eligible instead of permanently active.
• Microsoft 365: directory roles in Microsoft Entra ID, such as Global Administrator, plus the permissions granted to enterprise applications. Access reviews are the usual way to recertify them.

The common thread is the comparison of granted access against observed use over a window of time. Granted access comes from role assignments and policies; usage comes from audit logs or last-accessed data. Anything granted but not used in that window is a candidate for removal, subject to a human check that it is not needed for a rare task such as a year-end job or disaster recovery.

A dedicated CIEM product does the same across several clouds in one view. Whichever product you evaluate, check the vendor's current documentation for what it covers on each cloud.

Excess permissions are a quiet risk because nothing breaks while they exist. They only matter on the day an account is phished, a key leaks or an application is abused, and then the damage is bounded by what that identity was allowed to do.

NIST defines least privilege as the principle that a security architecture should restrict each entity to the minimum access needed to do its job, and it appears as a control family requirement in NIST SP 800-53. AWS's IAM best practices likewise tell you to grant least-privilege permissions and to remove unused users, roles, permissions and credentials. CIEM is how that principle is measured in a large, changing environment rather than only stated in a policy.

For an IT admin the practical effect is smaller blast radius. If a contractor's account or a forgotten access key is compromised, an identity with only the permissions it uses can do little. An identity that inherited broad roles years ago can read data or change configuration across a whole subscription or project.

A useful rule: CIEM is preventive and periodic, ITDR is detective and continuous, and PAM is about how privileged access is granted at the moment of use.

1. List your privileged identities. Start with global administrators in Microsoft 365, Owner and User Access Administrator on Azure, Owner on Google Cloud projects and administrator roles on AWS.
2. Look at non-human identities. Service accounts, access keys and app registrations are often the oldest and least reviewed grants.
3. Run the native unused-access reports. Use IAM Access Analyzer on AWS and the IAM recommender on Google Cloud, and review the suggestions before applying anything.
4. Make privilege temporary where you can. Eligible, time-limited role activation beats a standing assignment.
5. Remove in small steps. Trim one role, wait a usage cycle, then continue. Some permissions are used only yearly.
6. Repeat on a schedule. Entitlements grow back.