In their report (https://msrc.microsoft.com/blog/2023/03/guidance-on-potentia...) Microsoft doesn't even say whether end users were impacted. This seems to be a MASSIVE issue.
Not that you're wrong of course, but with an attack like that it wouldn't be accurate to say that every user is affected. At the same time, if you can't figure out if anyone was affected, what do you tell regulators?
They could definitely review historical or backup copies of their CMS databases for Bing, or database transaction logs, or whatever they have, to determine if this type of attack was ever launched. They'd have to correlate that to Bing visitor/usage records and hopefully be able to connect the dots. Even if they have the data to do this, I don't see them doing it.