The end-entity certificates I see for microsoft.com, azure.microsoft.com, portal.azure.com are all issued by:
C = US, O = Microsoft Corporation, CN = Microsoft Azure RSA TLS Issuing CA 0X [where X varies]
In any case, I just analyzed DigiCert's CRLs and it doesn't look like they've done many revocations yet. These are the only CT-logged certs revoked in the last 24 hours with reason code 4 (required when domain validation is done improperly):
The intermediate CAs which issue the end-entity certificates are operated by Microsoft.
Figuring out who truly issued a certificate is tricky business: https://www.agwa.name/blog/post/the_certificate_issuer_field...