I think the "at this time" is important, they were probably more focused on bringing everything back rather than doing a full investigation. I'm curious about the post mortem.

Microsoft employs enough people that they can afford to have one team scan for unusual ingress/egress traffic patterns while others work on troubleshooting. If not, they should not be shedding 60k employees right now.