This attack targets people's personal accounts. Many people have Office 365 because their work requires it, so they have to use the Outlook app for that. So if those people then choose to add their personal account to the same mail client, Microsoft can also snoop on the private correspondence of their captive corporate audience.