If they associate it with a Microsoft account (or anything that is identifiable) then it becomes PII.

And of course they are.

unfortunately under GDPR, anonymous IDs are personal data as they are used to single out a data subject.