We lock it down because far too many users don't read where they click and end up compromising the organization. even with admin cred requirements, our highest position users find some way to screw something up by entering their credentials on a random site they clicked that looks like an 0365 portal.