I'm confused as to why Microsoft needed to use this tracking ID at all.

Wouldn't Microsoft be able to trace the digital currency to the whitelisted test account? I'm assuming there's some kind of approval process for whitelisting test accounts (or at least you have to be in the right permissions group), otherwise anyone (even non-QA) could make a test account that bypasses their security.