“But, Microsoft found that the hackers were using that consumer MSA key to forge tokens that allowed them to break into enterprise inboxes.”
A key meant for Outlook.com accounts opened government inboxes because of what Microsoft calls a “validation error in Microsoft code.” Microsoft still won’t say how it lost the key, and its blog post carefully avoids the word vulnerability. The State Department caught the breach only because it paid for the top tier with the logs that showed it. Microsoft sold the security and then charged extra to see it fail.