Microsoft cannot move fast enough to present any real concern to someone who is dedicated.
The Microsoft login seems more reasonable, at that point they can filter out bad actors presumably.