By not having control over the endpoints where the data is encrypted and decrypted, and being trustworthy. Microsoft don't have the plaintext of Windows user's

By not having control over the endpoints where the data is encrypted and decrypted, and being trustworthy. Microsoft don't have the plaintext of Windows user's SSL encrypted web browsing, but they could if they changed their software to send them the plaintext too.