Even if the organization locks down employee accounts, forgotten and lost service accounts can still undo the organization's entire M365 environment.