Besides, in some services not even MS has control over the data, see KV or MHSM. In the very same link he posts: https://www.microsoft.com/en-us/security/blog/

Besides, in some services not even MS has control over the data, see KV or MHSM. In the very same link he posts: https://www.microsoft.com/en-us/security/blog/2023/07/14/analysis-of-storm-0558-techniques-for-unauthorized-email-access/ https://www.microsoft.com/en-us/security/blog/2023/07/14/ana... "Post-compromise activity Our telemetry and investigations indicate that post-compromise activity was limited to email access and exfiltration for targeted users." So it's not "all Microsoft". It's the usual exaggerated headline, but this time it draws attention on a person's post on Mastodon. This platform is really no different from Twitter.