I want to kind of echo Patrick's comments but more broadly. There are a lot of functions in AAD altogether that require pretty high-level rights to manage, making it hard to delegate to appropriate personnel without over provisioning them. A specific example: If a user reports Fraud via Authenticator, it requires pretty high rights to clear. I would love to be able to delegate this to our SOC, but not giving them all kinds of other access.