Entra Admins Get A Bit Too Friendly

It seems Microsoft Entra decided that the Agent ID Administrator role didn't have quite enough power, so it kindly allowed them to hijack high-privileged service principals across the entire tenant. Every tenant was potentially at risk of being commandeered by an over-ambitious administrator with a penchant for chaos. While Redmond claims to have deployed a fix across the cloud, one might protect oneself by actually checking if their identity architecture is built on sand before the next "oops" moment occurs.