My idea : if ALLOW MICROSOFT SERVICES is set to ON, then Microsoft should not send us attack alerts when IP is owned by Microsoft.
Customers don't have to study or manage Microsoft Ranges IPs, because THAT ALLOW exists for this reason.