Managed doesn't mean automatic
You still configure access policies and admin permissions in Entra services. Set Conditional Access policies (Entra ID). Assign admin roles and permissions (Entra ID). Control who administers the managed domain (Domain Services). Managed equals less patching, not less responsibility.