Sure, no worries.... So with cloud migration, everything is accessed with a user account/username and password. If you take Microsoft's cloud world, for example, your username/password can access everything from Outlook/Office, Azure, DevOps, GitHub, an Xbox Live account, any application in the tenant, etc.
You are correct that you need to have the correct access and permissions to access certain items, but it is also possible to elevate privilege via other means.
Applications, for one, have many read/write permissions that can be granted by an admin. That gives a non-privileged users more privilege when using that application and create an opening for a would be hacker.
The Twitter breach that recently happened was due to internal accounts that elevated privilege to disable MFA for accounts and be able to have access to all inbox and post messages.
The Capital One breach, again due to misconfigured user accounts.
Precisely on your question, can a misconfiguration allow a user account to have access to something they should not... yes. That is how many breaches occur.
In larger companies, people leave the organization, join the organization, get promoted, get new responsibilities, etc. This causes the admin team to make changes to configurations. Overtime, those may be forgotten about, not properly tracked, or simple done incorrectly. This causes configuration drift over time.
The user identity and access needs to be correct all the time, as the bad guys only need to be correct once to do massive damage.
To clarify on Azure Active Directory... Many companies use Office and have migrated to Office 365 or Microsoft 365. When doing so, it takes those user accounts and creates an account for each in the Azure Active Directory.
When companies fail to realize this, they fail to understand that they have an Azure tenant and are part of the Azure cloud environment. Many companies would still use the Office 365 admin functions to perform admin duties, but many of these could present security challenges over time.... For example, MFA through Office 365 is now considered legacy MFA and should be replaced by Azure MFA. This can be done with a click of a button by enabling security default in companies that don't do much in the Azure space except use the office suite. However, some companies that do not have security teams and knowledgeable Admins when they make the cut over from On Prem to cloud, could easily not know about his or understanding it.
