I managed to find out how it theoretically works: Support user getting CID through WebAct (Microsoft Self Service for Mobile site). https://borncity.com/win/2017/02/12/microsofts-obscure-self-service-for-mobile-office-activation/ so it seems safe to me, even if they could explain its operation more transparently.