Microsoft just patched a built-in Entra ID role they shipped as scoped to "agent identities" — and which, in practice, let anyone holding that role take over almost any service principal in the tenant. The fix rolled out across all clouds on April 9. The disclosure went public last
