It goes on to say:

> The EDPS has also decided to order the Commission to bring the processing operations resulting from its use of Microsoft 365 into compliance with Regulation (EU) 2018/1725.

Which, to me, reads like they can keep using Microsoft 365, they just need to work with Microsoft to bring it in compliance.

So my guess is your second interpretation.