It is a best practice to add DMARC to the onmicrosoft.com MOERA domain.
All of our customers use their own domainname, so the MOERA domain is always an inactive domain. However to qualify for a free inactive domain, there has to be a defensive SPF record. The SPF record for a MOERA domain is managed by Microsoft.
Please add support for free inactive MOERA domains.