Microsoft gives its partners power to change AD privileges on customer systems – without permission

Somewhat counterintuitively, this is being done to improve security
Microsoft has created a window of time in which its partners can – without permission – create new roles for themselves in customers' Active Directory implementations.…