Microsoft has mitigated the acquired MSA key and taken the following preemptive measures:
Microsoft blocked the usage of tokens signed with the acquired MSA key in OWA preventing further threat actor enterprise mail activity.
Microsoft completed the replacement of the key to prevent the threat actor from using it to forge tokens.
Microsoft blocked usage of tokens issued with the key for all impacted consumer customers.