Microsoft just patched a built-in Entra ID role they shipped as scoped to "agent identities" — and which, in practice, let anyone holding that role take over almost any service principal in the…