It is easy to not find evidence of something if you don't look to hard.
This is a case where even if there were IOCs and you found them the clean up would be nearly impossible. Think about their 'Shared Responsibility Model' and the implication here. If MS were acknowledge some kind of serious breach occurred in their core Entra-ID IAM platform...they'd either have to be able to be able to conclusively identify all the impacted subscriptions or every single one of their subscribers would have to kick off their own IR process because how could they know they have not been backdoor'ed from inside their subscription.
Microsoft does 'dog food' so if Entra was exploited MS's internal management is possibly compromised so they could not be 'certain' about the impacted customers, at best they might get some sort of 'beyond a reasonable doubt level of certainty but we could never hit the 'yes the sky is blue standard'.
A not insignificant portion of MS clients (even pretty big important ones) likely have pretty deficient IR capabilities, independent of if they know it or not. Even the good ones are not at the 'we can assuredly remove any persistence work a state-level-actor did on our compromised systems' level without resorting to a large scale rollback-restore. Think the Azure infrastructure could handle that level of activity, the amount of storage-I/O to do all the analysis and IOC searches? the compute and I/O to do mass restores, all in small window...doubtful?
There is also the core defect in MS's approach to authentication that go back to the earliest days of NT, Microsoft stuff gratuitously authenticates all-the-time...Even when that isn't being directly exploited to gather authentication assets like hashes etc for attacks, it means the number and often meaningless or outright spurious log events make understanding what an actor malicious or otherwise was doing with an given set of credentials in terms of intent challenging. (Don't attack me for this statement I did not say impossible, IR professionals and good network security admins can, it just isn't simple.) Which adds a lot of cost to cleaning up an incident like this - if one were to be triggered.
So I don't think we should over look the POWERFUL motivations to declare this one contained. I do think we should recognize that Azure and AWS are probably 'TBTF' and really Congress should be taking a hard look at forcing some divestment and perhaps limiting the size of SaaS/PaaS providers in general. It is just to many eggs in one basket, there is a serious National Security and economic risk here. It comes down to a poorly managed or neglected mill pound might flood a few neighboring farms from time to time but if the damn breaks a large hydro electric resivor it might wipe entire towns off the map. The former might happen a lot more often because of who is in charge, and what resources the have to secure and maintain it, but you have to look at costs in terms of impact * probability. At some point the impact factor is just to large, for anything but a zero probability to be tolerable.
