“Microsoft had configured a non-production test tenant account without two-factor authentication enabled, allowing Nobelium to gain access.”
The SolarWinds crew got into Microsoft with a password spray against a test account that had no two-factor. From executive email it moved on to source code repositories and internal systems. Customers had emailed Microsoft secrets, and Microsoft is now contacting them one by one as it finds those secrets in the stolen mail. Microsoft could not be bothered to turn on MFA for its own test tenant.