But there's the problem: if you don't have an OSM account, the user needs to go sign up for one. If Microsoft creates the account for them, that's not just legalese, they might still be seen as the data controller. Or, at least it may be problematic enough to give the in-house lawyers a headache.