Azure's services offer multiple levels of input sanitization/filtering and filtering input is one of the current cornerstones of mitigating injection attacks. If Azure dows it, I imagine all the main players do.
This issue aside, if anyone has the keys what value are they in the end? Has Microsoft ever refused to unlock someone's pc stating that they could not technically do that? Isn't storing keys like this akin to storing passwords in clear text?