How to Remove Unused Managed Identity Permissions in Entra Permissions Management

Why the Answer Is Correct

Autopilot rules in Microsoft Entra Permissions Management are the built-in automation engine for permissions hygiene: you define a condition (for example, permissions unused for 90 days, scoped to managed identities or service principals) and the rule performs the action automatically, such as revoking the unused permissions or triggering an alert. Because the requirement spans both identification and removal, and explicitly says to minimize administrative effort, an Autopilot rule is the only option that closes the loop by itself. As rvln7 put it, Autopilot rules "allow you to automatically revoke unused permissions based on a predefined policy." The 90-day unused condition is exactly the kind of threshold Autopilot supports for permissions on managed identities in onboarded Azure, AWS, and GCP environments.

Why the Other Options Are Wrong

Scheduling a Permissions analytics report (B) does give visibility into permissions and their last-used date, but it is an output-only artifact: someone still has to open it, evaluate the findings, and remove each permission, which directly contradicts the minimal-effort requirement. That is the point armid makes with "remove" not sure how scheduling the report will help you. Reviewing service principals with privileged role assignments in Microsoft Entra Insights (C) focuses on directory role assignments rather than unused cloud resource permissions and offers no removal workflow. Running an audit query (D) is a forensic/investigation activity for tracing activity in the audit logs, not a governance control that revokes entitlements. Only Autopilot rules perform the action, not merely the discovery.

Community Comment Notes

Most learners landed on A (67 votes) with reasoning that matches the official product behavior, and rvln7 explicitly flagged the report option as incorrect because it only identifies unused permissions. aleksandur_nasev argued for B on the grounds that the report identifies permissions unused for 90 days, which is true but stops short of the stated goal of removing them. armid's comment captures the deciding word in the stem — the solution must remove permissions, and manual removal is administrative effort. The dissenting vote therefore reflects a common reading error rather than a different product feature.