>I think the bigger question is why they were using microsoft products in the first place.
Public institutions in Europe, in my experience, often have a confusing insistence on using Microsoft cloud products. Universities heavily push Office 365 and Teams, often trying to demand that faculty use them, while faculty continue to use alternatives as much as possible in order to actually work effectively. During the pandemic, the only online conferences I attended that insisted on running via Teams, against all reason, were run by a UK public institution, and they had as many embarrassing technical problems as might be expected.
This is despite Microsoft's cloud services being generally designed for businesses and often poorly suited for public institutions, especially universities. The services are fundamentally built with the assumption that work will primarily take place within a single organization, with clearly defined employees. European research collaborations constantly seem to be hobbled by needing to use hacks around this assumption, but the inexplicable importance of using Microsoft seems to outweigh these problems. In the most ridiculous case, a conference online during the pandemic asked everyone during registration to please not register using their university email address, but to use a personal one not associated with any Office 365 account, because they had no way of allowing access to Teams if the email address was managed by Microsoft at a different university. Yet still the importance of using Teams was paramount to the organizers.
I have had no clear explanation of why using Microsoft services is so important, despite them being so poorly suited to the institutions, so opposed (and often just not used) by many of the actual users, and arguably being used in ways that they are not really intended to be used. I've had some people claim it is necessary for GDPR compliance, despite the GDPR compliance of any US company being on shaky ground. Microsoft itself has described what seem like rather extensive contingency plans around US-enforced GDPR violations or requirements for service cutoffs (there is a blog post somewhere), but these must also imply a fear that such things could actually happen (and, of course, actually did happen with the ICC). It all seems rather strange.