Machine identities outnumber humans 109 to 1 in the average Microsoft 365 tenant, and most are ungoverned. Part 2 of The Security Bridge series breaks down why service principal ownership, not directory roles alone, is the real takeover path: how a stolen credential inherits every permission an app holds, and why 99% of tenants already have at least one privileged service principal exposed. Includes 3 real examples and a validation checklist for security architects, engineers