Microsoft Entra ID bug lets attackers impersonate any synched user