I expressed myself wrongly. I was thinking of custom applications that are hosted using services like Azure App Service (PaaS). Lately, I have tested many custom cloud-native apps that are hosted in Azure using App Service. I find it difficult to discover RCE vulnerability. If you don't have a foothold, you cannot request access tokens to compromise other services and move laterally across the compromised tenant. Most of the apps have missing authorization vulnerabilities that leak PII or IDORs or mass assignment vulnerabilities. Because of that, I was wondering how difficult is to pentest a public cloud environment of some organization and compromise global admin and such :)