They’re their own certificate authority and they let their intermediaries expire too. It’s partially automated they just don’t monitor it. Similar to when your certbot reports it couldn’t renew because of whatever reason, maybe dns validation failure or whatever. It usually tells you like 30-60 days before expiry and there’s lots of time.

Microsoft has both the tools and knowledge and still doesn’t get them all. Every year. One time it blocked mfa and login services. Sometimes it’s just teams. It’s like they just figured instead of staff monitoring they figure user feedback like their insider program is just cheaper.