Lawful basis - contract
Microsoft will probably have a contract with the Dutch Gov that gives them the right to collect the data.
As far as the report goes, there has been no breach, so no reason for the Dutch Info Commission to get involved with Microsoft.
The Dutch government, however, may be breaking GDPR by sending data to Microsoft without its worker's consent. Dutch GDP - 826.2 billion USD - now that is quite some fine they can impose on themselves...