Supported Entra-only bootstrap for a locked BYPASSRLS role on Azure PostgreSQL 16

On a disposable, private Azure Database for PostgreSQL Flexible Server 16 with Microsoft Entra-only authentication, the sole VM managed identity is the authenticated database owner and has CREATEROLE. CREATE ROLE for a NOINHERIT NOLOGIN BYPASSRLS role returns SQLSTATE 42501. A separate read-only check showed that the login can assume azure_pg_admin, but azure_pg_admin has neither rolcreaterole nor rolbypassrls on the test server. What supported self-service or Microsoft-assisted procedure can initialize this locked role while keeping Entra-only authentication and leaving application and ordinary migration identities without elevated privileges? This concerns a synthetic restore rehearsal. The disposable resources were removed.