While an API flaw that enabled the attack to succeed has been fixed, Microsoft is still trying to figure out how the attackers were able to acquire an Azure Active Directory key in the first place.