Tag
Enterprise-managed auth moves the privilege decision off the consent screen and onto identity policy. The blast radius moves with it.