The issue is Microsoft has their own people who have mission and authority similar to CISA but scoped to the organization as do many of the other institutions I see making this class of error.
It isn't that institutionally they don't know better, or even individually they don't know better, it is an operationalization problem and there simply exists to much pressure in terms of time time to be sloppy with a credential, coupled with the near certain knowledge that even if that sloppiness is process or policy violation it is sure to go unnoticed or at least unpunished unless something bad happens and even then it still might not carry much in the way of personal consequences.
Fundamentally SaaS/PaaS/Cloud security is far to reliant on not just everyone knowing what they are supposed to do, but actually doing it dependably and consistently everyitme. It simply does not work at scale.
Zero-trust just isn't a very good model over all because it makes everything about identity and discretionary access management, and people are just not that good at identity management. They are better about DAC, but even then there is a lot of templatation to just say sure give'em repo access.