Defender for Cloud CIEM Over-Provisioned Identity Recommendation Not Consistent Across Management Group Inherited Roles

Hey! This is a great (and very common) question when you start using CIEM/DSCPM in a large management-group hierarchy.

Based on the provided documentation, here’s what we can say confidently, and where the gap remains.

What Defender for Cloud CIEM/Permissions Management is doing (high level)

• CIEM is part of Defender for Cloud Permissions Management (DSCPM).
• The CIEM engine continuously analyzes entitlement and behavior risk using:
  • Microsoft Graph CIEM APIs (primary source for entitlement/activity evaluation)
  • Azure Resource Manager (ARM) Activity Logs (used to validate inactivity/over-provisioning patterns)
• Findings include:
  • Inactive identities
  • Overprovisioned identities (excessive privileges relative to usage)

Why you may see recommendations only for “directly assigned” roles

The docs you provided don’t explicitly confirm whether the over-provisioned identity calculations evaluate:

• inherited management-group role assignments, versus
• only roles directly assigned at subscription scope.

So we can’t truthfully answer: “Does it evaluate both?” from the supplied materials.

However, we can explain two important behaviors that can make the UI look inconsistent:

1) CIEM findings can lag behind changes / inheritance effects

CIEM data is refreshed on a periodic cycle—typically within 24 hours. The docs note that CIEM uses Microsoft Graph and ARM activity data, which may not immediately reflect permission changes.

So if you recently changed assignments (including management-group role assignments), the “missing” recommendations may simply be an update/sync timing issue.

2) The displayed recommendations are tied to the DSCPM plan, not “CIEM alone”

While this doesn’t directly answer your inheritance question, it’s relevant operationally:

• CIEM recommendations remain visible if DSCPM is still enabled.
• If DSCPM is disabled, recommendations are removed after the system syncs (up to 24 hours).

In other words: make sure the relevant plan is enabled consistently across the environment, because that can affect what’s computed/displayed.

Should inherited management-group roles be included?

The provided documentation says CIEM provides an “effective permission analysis” and a unified entitlement view, but it does not specifically state how management-group inheritance is handled in the overprovisioned identity recommendation logic.

So: the docs don’t let us conclusively answer whether inherited management-group roles are included in the recommendation calculation.

Practical guidance you can give in the forum (based on what’s supported)

Here are the safest suggestions aligned with the docs:

1. Wait for the CIEM sync cycle If role assignments (including at management group level) were recently made/changed, wait up to 24 hours for findings to refresh.
2. Verify DSCPM is enabled Confirm DSCPM is enabled under Defender for Cloud → Environment settings → Defender plans. CIEM recommendations are tied to DSCPM.
3. Use CIEM’s unified entitlement search to validate effective permissions The docs describe Cloud Security Explorer as a way to search for a specific identity and determine “who has access, what level of access they have…”. That’s the best place to validate whether the identity truly has the overprivileged effective permissions across all subscriptions—regardless of whether recommendations are surfaced per-subscription immediately.

Follow-up questions (to get you to an accurate answer)

To determine whether this is expected behavior vs. an engine/UI limitation/bug (and to help the customer accurately remediate), can you ask the customer:

1. Are the management-group role assignments recently changed (within the last 24 hours)?
2. Are both features running under the same licensing/config: Defender for Cloud Permissions Management (DSCPM) enabled for the subscriptions in question?
3. For one “missing” subscription (where the role is inherited), what does Cloud Security Explorer show for that identity’s effective permissions?
4. What exact RBAC role(s) are involved at the management group level and at the subscription level (role names)?
5. Are there any policy assignments or role assignment differences between subscriptions (e.g., additional assignments, deny assignments, or not having the same management group scope)?
6. Are these findings for a user or service principal? (CIEM has different finding types/APIs.)
7. Roughly when did the recommendations start showing up on the two subscriptions with direct assignments?

Relevant documentation (all provided)

• CIEM overview / capabilities (Microsoft Defender for Cloud Permissions Management): https://learn.microsoft.com/azure/defender-for-cloud/permissions-management
• CIEM finding data sources + APIs (from the CIEM section provided):
  • Inactive User Finding API: https://learn.microsoft.com/graph/api/inactiveuserfinding-get?view=graph-rest-beta&tabs=http
  • Overprovisioned Service Principal Finding API: https://learn.microsoft.com/graph/api/overprovisionedazureserviceprincipalfinding-get?view=graph-rest-beta

Hope this helps—if you can answer the follow-up questions (especially #3 and #4), we can tighten the guidance and determine whether this is timing/inheritance coverage or something else.

Note: This content was drafted with the help of an AI system.

1. Are the management-group role assignments recently changed (within the last 24 hours)? -- No
2. Are both features running under the same licensing/config: Defender for Cloud Permissions Management (DSCPM) enabled for the subscriptions in question? - so we have upgraded the licensee that is CSPM in defender for cloud last year on all our subs and enabled the CIEM as well from settings.
3. For one “missing” subscription (where the role is inherited), what does Cloud Security Explorer show for that identity’s effective permissions? -- This needs to check
4. What exact RBAC role(s) are involved at the management group level and at the subscription level (role names)? - roles like owner, security admins, contributors etc..
5. Are there any policy assignments or role assignment differences between subscriptions (e.g., additional assignments, deny assignments, or not having the same management group scope)? -- Can you specify the request what you're asking give example
6. Are these findings for a user or service principal? (CIEM has different finding types/APIs.) -- so we have users and service principles both in the recommendation
7. Roughly when did the recommendations start showing up on the two subscriptions with direct assignments? -- From the last year when cspm is enabled

@Dikshant Lather

The next step is to use Cloud Security Explorer to confirm the identity's effective permissions based on your description. The effective access view should display any Owner/Contributor/Security Admin roles that the user or service principal acquires from the Management Group.

The advice might be scoped to the assignment location rather than each subscription where the permission is inherited if Cloud Security Explorer displays the inherited permissions but only generates the over-provisioned recommendation for direct subscription-level assignments.

To confirm this, please check one affected identity on a subscription where the role is inherited and share whether the inherited role appears in Cloud Security Explorer.

Also, regarding the earlier question about assignment differences, examples include:

• Deny assignments
• PIM eligible vs. active assignments
• Additional direct role assignments
• Different management group inheritance paths

We can ascertain whether this is typical CIEM behavior or something that needs more research once we know what Cloud Security Explorer displays for the inherited subscription.

Hello @Dikshant Lather Following up to see if the above provided information was helpful. If you have any further queries do let us know.