Ya. The FBI report to the court said that Microsoft showed the GDID visited the ngrok.com/signip page while using a VPN. I would have figured at that level the OS would not know domains but likely IP addresses. So it must be browser telemetry right?
Have you paid attention during any of the Administrations? In this post-Snowden era we have no excuse for not knowing the "government of the people" has been doing this to companies for a long time. AT&T for example. This Administration just does it out in the open.