Microsoft gives its partners power to change AD privileges on customer systems – without permission

Somewhat counterintuitively, this is being done to improve security

Microsoft has created a window of time in which its partners can - without permission - create new roles for themselves in customers' Active Directory implementations....