Exercise 3: Why an Identity-Layer Flaw Is Different in Kind, Not Just Degree — Possible Solution ==================================================================== A vulnerability in a single Azure service (say, a flaw specific to one storage service's own access controls) is real and serious, but its own real blast radius is naturally bounded -- it can only affect resources actually using that specific, single service, and only within whatever real permissions were already granted around it. Entra ID is genuinely different in kind, not just in degree, because it is the identity layer every other Azure access control described in this chapter ultimately depends on -- RBAC role assignments, Managed Identities, and every scope in the Management Group -> Subscription -> Resource Group -> Resource hierarchy all rely on Entra ID correctly enforcing who someone actually is and what they're actually allowed to do. If the identity layer itself can be tricked into granting administrator privileges across every directory, then every one of those other real controls -- however carefully configured -- can potentially be bypassed at once, since they all sit downstream of the same compromised foundation. ANSWER: A flaw in a single service is bounded by that service's own real scope; a flaw in Entra ID itself is potentially unbounded across the entire identity system, because every other access control covered in this chapter (RBAC scopes, role assignments, Managed Identities) depends on Entra ID functioning correctly in the first place. This is exactly why the real 2025 vulnerability -- allowing administrator privileges "across every Entra ID directory" -- was treated with such urgency, fixed in just three days. WHY THIS WORKS AS AN ANSWER ------------------------------ This correctly explains WHY identity-layer flaws are categorically more severe than service-specific ones (every other control depends on it), rather than simply asserting that identity is "important," and ties the explanation directly back to the chapter's own real, documented severity and rapid three-day fix timeline as supporting evidence.