Sonrai Security Explained: CIEM and the Cloud Permissions Firewall, and What Replaced Entra Permissions Management

In most cloud estates, identities hold far more permissions than they use: roles granted "just in case", services nobody turned off, regions nobody operates in. Cloud infrastructure entitlement management (CIEM) tools measure that gap. Sonrai Security's approach is distinctive enough to be a good interview example: it turns the gap into organisation-wide deny policies.

What it is

Sonrai is a private CIEM company. Its main product, the Cloud Permissions Firewall, analyses which privileged permissions, services and regions are actually used. It then generates organisation-level policies that block what is unused, with an approval flow for exceptions. Related features include Permissions on Demand (time-bound access to privileged permissions), quarantining unused "zombie" identities, and an AI agent called WALLy, announced in October 2025.

Sonrai launched the firewall on AWS in 2024. Its January 2026 announcement said it was available on AWS and Google Cloud, with Azure "coming soon". Its product page claims all three, so check Azure availability before relying on it.

Lineage note. Microsoft bought the CIEM company CloudKnox in 2021 and sold it as Microsoft Entra Permissions Management. Microsoft ended sales in 2025 and retired the product on 1 November 2025. It recommended Delinea's Privilege Control for Cloud Entitlements as the replacement, and kept some permission analysis in Defender for Cloud.

How it works

On AWS, the controls are service control policies (SCPs) and resource control policies (RCPs) applied through AWS Organizations. You pick a scope and an action, such as protecting privileged permissions with exemptions for named identities, protecting a service, or disabling an unused service or region. The change goes to Pending Changes, and Sonrai produces a CloudFormation template for you or your AWS organisation administrator to deploy. Existing SCPs and RCPs can be imported so the generated policies fit alongside them. Because organisation policies have size limits, Sonrai's guidance is to plan protections carefully; it notes that most customers use around 30 AWS services per account.

How to use it

Day one: connect and observe

Connect the cloud organisation read-only and let usage analysis run long enough to see monthly and quarterly jobs. Thirty days of data will miss the quarterly finance export or the annual disaster-recovery test.

Week one: start with the safest wins

1. Disable unused regions. Attackers like quiet regions, and few legitimate workloads move into new ones by surprise.
2. Disable unused services per account.
3. Protect sensitive permissions such as IAM administration, key management and logging configuration, with exemptions only for the identities that use them.
4. Stage changes through Pending Changes and deploy the template through your normal infrastructure change process.

Every day: run exceptions as a service

Use Permissions on Demand so engineers can request privileged access through chat with an approver, rather than keeping standing permissions. Review exemptions monthly, quarantine identities that have not been used, and watch for workflow breakages after each deployment.

Where it stops

• Usage is history. Rare but legitimate jobs, such as incident response tooling or annual tasks, may look unused; plan exemptions and a fast unblock path.
• SCP limits. Organisation policies have size limits and do not apply everywhere; for example, SCPs do not restrict the AWS Organizations management account, so it needs its own controls.
• Deny policies can break production. Roll out by organisational unit, starting with non-production.
• Coverage varies by cloud. Check what is generally available on each provider.

How it comes up in interviews

• "How would you remove unused cloud permissions without breaking production?" Usage analysis over a long enough window, staged deny policies, exemptions, and on-demand access.
• "Why block unused regions?" Reduced attack surface and detection value: activity there is suspicious by default.
• "What replaced Entra Permissions Management?" A good check of whether you follow the tooling landscape.

Sources

Checked on 13 November 2026: Sonrai Cloud Permissions Firewall documentation (introduction, pending changes and Permissions on Demand); Sonrai product page; Sonrai newsroom post of 6 January 2026; SiliconANGLE on WALLy (7 October 2025); Microsoft Entra blog "Important change announcement: Microsoft Entra Permissions Management end of sale and retirement" (published 1 April 2025, updated 29 September 2025); Microsoft announcement of the CloudKnox acquisition (21 July 2021); AWS Organizations documentation on service control policies.