For a brief, uncomfortable moment, it looked like any standard user in any tenant could make themselves a Global Administrator using only Microsoft’s own first-party tools. That fear turned out to be wrong — but the reason why is far more interesting, and far more revealing about how …