Unless there is no opt out.. Unless the data is for core functionality, a lawful purpose you have to have consent. I would consult a lawyer on this if you have any doubts. I suspect Microsoft have done already though.