Automatic full disk encryption, with the encryption key stored at Microsoft, has been a standard "feature" for non-local/domain accounts for many years:

Microsoft may have your encryption key; here’s how to take it back https://arstechnica.com/information-technology/2015/12/micro...