Microsoft security tools questioned for treating employees as threats