[rootsudo]

This is assuming the domain has it, but it's even easier actually - you can just DIG DNS records and see if what they run as MX, cnames, etc, if there is teams DNS records and the MX record points to *.onmicrosoft.com or $tenantname.mail.protection.outlook.com there you go, even easier than "querying" google and seeing what's index.

And much easier to script too. ;)

[technion]

You can also enumerate that tenant and see which businesses share infrastructure/accounts.

https://github.com/technion/azure_enum

[altdataseller]

This shows you which domains uses Microsoft365 though not Azure AD