
What Storm-2949 Actually Broke: Identity Governance, Not Self-Service Password Reset
Microsoft's Storm-2949 disclosure exposed an identity governance gap, not a password gap. What service-principal hygiene, JIT RBAC, and lifecycle attestation would have caught.
