What would be a reasonable amount of time to audit the dependencies?

I would let them decide based on their security policy.

If Microsoft states that they don't have any for a project like this, I would be wary of taking it too seriously.