I would let them decide based on their security policy. If Microsoft states that they don't have any for a project like this, I would be wary of taking it too

I would let them decide based on their security policy. If Microsoft states that they don't have any for a project like this, I would be wary of taking it too seriously.