It must really depend on the org, because Azure is a security shitshow that indicates multiple teams there haven't even dreamt about thinking about security. Multiple highly critical cross-tenant vulnerabilities in the span of two years, some of them trivial, is not a good look on Microsoft as a whole.