As a result of this experience I now consider having any relevant data or system access behind Microsoft ID (or any other as Apple or Google) as risk which needs mitigation. I removed all my data from OneDrive and set up my O365 not storing data in the Microsoft cloud (I needed MS support to do so. Not using OneDrive does not do the job).
I consider using my Microsoft/Google/Apple IDs on other sites as adding to the risk to be cut of my data or work at Microsofts mercy.