Microsoft Entra Permissions Management

This is the foundational step. It connects Permissions Management to your various cloud environments (Azure, AWS, and GCP) and your Microsoft Entra identity system. This allows the tool to "see" and analyze the permissions within those environments.

The "controller" likely refers to the core engine within Permissions Management that actively monitors and enforces policies. Enabling it activates the active management features, while disabling it might put the system in a passive reporting mode.

Cloud environments are dynamic. This feature allows you to add new AWS accounts, Azure subscriptions, or GCP projects as your cloud footprint grows, ensuring continued coverage by Permissions Management.

As you manage numerous cloud accounts and resources, organizing them becomes crucial. Folders help you group related Authorization Systems (AWS accounts, Azure subscriptions, etc.) for easier management and reporting.

This is very important for a comprehensive security approach.

Integrates with AWS's identity management system.

Provides a central view of all the cloud accounts and resources that Permissions Management is monitoring, giving you a high-level overview.

Likely refers to managing user profiles and related data within the system, potentially for reporting and auditing purposes.

This is a core function. It allows you to see:

Who (users, groups, service accounts, workloads) has what permissions.

This is where you define and manage the roles and policies that grant permissions. It also includes managing the process for users to request access to resources.

You can configure the system to send alerts when specific events occur, such as a user being granted excessive permissions, a new resource being created with overly permissive access, or suspicious access patterns being detected.