Another annoying thing about this wrt them discouraging it, you need a Microsoft professional/enterprise account (I forget what they call it) to see the sha256 hashes, which they used to make publicly available until a few years ago