https://dirkjanm.io/abusing-exchange-one-api-call-away-from-domain-admin/