That's the crux of this. There are no surprises in AAD behavior here, it's just that Microsoft put developers or security people on these products that missed t

That's the crux of this. There are no surprises in AAD behavior here, it's just that Microsoft put developers or security people on these products that missed the mark. Everyone makes mistakes in their careers, but these are some awfully big mistakes with awfully big stakes.