Why would they? The immediate concern is whether or not the exploits are still a risk, not determining the origin. Any future use of them is likely to be groups

Why would they? The immediate concern is whether or not the exploits are still a risk, not determining the origin. Any future use of them is likely to be groups other than NSA at this point anyway. If/when Microsoft do call out the NSA, I imagine it'll a) be filtered through their press/PR teams and b) be after they've had time to verify the source (it seem overwhelmingly likely to be NSA-originated, but I'd guess MS will do their own investigation and not just take it at face value).