Windows logged the exact ngrok URL a suspect opened, down to the second (pcmag.com)
The arrest exposed that Microsoft keeps a Global Device Identifier for every Windows install and can correlate it with the IPs it used and the URLs it reached. What unsettled the thread is the scope, not the ID itself.
The sharpest question is which layer does this. A machine ID sitting on disk is normal; an OS vendor tying it to your live network activity is not. Nobody could say for sure whether it's Edge, Defender, or something lower in the stack.