1) In this case the laptop was taken to Iran, so that's what we are talking about here.

2) I can assure you there's policies at Microsoft that include performing work abroad and accessing any company resources from abroad. Obviously nobody will be approved to access any company resources from Iran, especially not source code.

3) I can say there is policies at MS this with a very high degree of confidence because I personally have done work with Microsoft involving code and data that is export restricted.

4) Companies should have policies in place in order to avoid situations like this. Taking your company laptop to, say, Germany probably isn't a big deal for most companies, but any "exporting" company assets should at least be pre-approved/documented.

I checked with my old classmates who currently work at Microsoft and LinkedIn, and they do not require permission for accessing company resources from abroad. One of them has been working from Israel and Turkey for many months in 2020. Another has been in Mexico since the pandemic began.

I'm not sure what team you worked in, it's possible some teams have stricter policies. If you were doing business with Microsoft, the export control language is boilerplate contract language.