At least they'd (Microsoft) have to make the changes publicly available, since it's AGPL. So they can't have secret shenanigans that others don't have.
Genuinely don’t understand. Is the ActivityPub protocol AGPL? Is there something stopping MS from just building their own server from scratch?
They would also make a Microsoft owned version of the protocol to support features only their client and server supported
Why wouldn't they just implement SOAP over JSON?
ActivityPup is an API.
APIs are not protected by copyright.
The AGPL only applies if they make it available externally though. If they have their own internal instance the AGPL only says that Microsoft employees must be able to access the source code.
Microsoft hosts teams for their customers. So if they modified the code all their customers users would be entitled to see it.
While I agree with this, I've interfaced with many lawyers that interpret AGPL differently mostly due to following license dependency trees. They nuked any project that went anywhere near AGPL even if the project was internal-only. This was not limited to places I worked either. There are others in my circle that had their projects shot down for using AGPL code. I do not fully grasp the logic the lawyers arrive at. Perhaps they are treating it the same way I treated PCI compliance, in that anything touching it gets infected by the zombie virus and must also be compliant.