What do you mean? The FBI could know that this VPN ip visited ngrok and then the retailer website, but how would it know that that ip was associated with the specific GDID unless microsoft was tracking (timestamp,website,gdid) tuples?
Probably Windows constantly pings the MS server and they record those tuples.
Probably Windows constantly pings the MS server and they record those tuples.