Well, they consent to the fact that data is "synced" to Microsoft. That is the use case and the consent-able item. The password is just a random property of that item. And that is literally on the screen. That is broad but that is how privacy topics are generally handled.

I also do not like it.

If the data includes credentials but that isn't explicitly mentioned when asking for consent, I seriously hope that won't hold up before a judge.

I would not bet on that.