An organization uses Microsoft Entra Permissions Management (CIEM - Cloud Infrastructure Entitlement Management) to monitor Azure AI service permissions. The security team wants to identify service principals with unused permissions to Azure OpenAI resources that have not been exercised in the past 90 days. Which Permissions Management capability provides this analysis?
Select an answer to reveal the explanation.
Short Explanation
Here's the deal — you want the Permission Creep Index report filtered for Cognitive Services because it compares permissions granted with permissions actually used. That lets you spot service principals with Azure OpenAI rights they haven't exercised in 90 days, so you can trim them.
Full Explanation
The correct capability is the Permission Creep Index (PCI) report filtered for Cognitive Services resource type. Microsoft Entra Permissions Management, formerly CloudKnox, provides a Permission Creep Index that measures the gap between permissions granted and permissions actually used; Microsoft Learn describes it as an aggregated metric that evaluates risk from unused or excessive permissions across identities and resources (https://learn.microsoft.com/en-us/entra/permissions-management/overview, https://learn.microsoft.com/en-us/entra/permissions-management/faqs). By filtering for Cognitive Services or Azure OpenAI resource types, administrators can identify service principals, users, or groups that have been granted permissions to Azure OpenAI but have not used them in the past 90 days, or another configured period, enabling right-sizing through permission revocation. The usage analytics dashboard in Microsoft Entra admin center is wrong because it shows sign-in patterns and app usage, not unused cloud resource permissions. Microsoft Defender for Cloud CSPM recommendations for unused identities is wrong because it recommends removing unused identities and excess permissions through security recommendations, but it is a posture tool; Permissions Management provides deeper CIEM analytics with usage data. Azure Advisor security recommendations for identity is wrong because it provides general best practice recommendations including right-sizing compute and cost optimization; it does not provide detailed identity permission usage analytics.