They can do whatever they want. If they aren't currently able to do it, they can create a law that will allow them to do so.
Look at China and Google a few years ago. China said, you must do this. Google said take a hike. China said get out of our country. If you want to do business in a country, you need to follow their rules, no matter how much you dislike them, or move your operations elsewhere. That said the end result of the above was Google doing exactly that. Now which would hurt more, MS not doing business with the US or the US not doing business with MS?
The again this has more far reaching than just MS, as all companies doing business with the US may be affected, so perhaps the US will back down.
That said this is ALREADY happening to entire countries, so I am not sure how a corporation is going to matter much. The US has already done this to the banking system, basically saying that all banks everywhere must comply and give all personal information over to the US in their search for tax evaders. It is supposed to only be used against US citizens, however in practice that will not be the case as many will be fishing trips for possible citizens. This is done. Countries were given the option of not doing business with the US banking system (how many do you think agreed to that?).
So I have a feeling that MS and Co. will bitch and moan for PR purposes, but in the end will capitulate.