In addition to what others said about cookies and security, there's also organizational issues as well. In a giant org like Microsoft, services are launched by different groups at different times, and not always (or better said, rarely) in a coordinated manner.
If I had to guess, the team that made microsoftonline.com probably could have dealt with the group that "owns" microsoft.com and gone through all the security, functionality, routing and systems testing involved to add a new subdomain or root-level path, but it was faster, easier and safer to just use a new domain and not worry about 25 years of domain name baggage. Maybe it was actually a coordinated effort to avoid all that, or simply meet a deadline.
You never know. The longer you work in technology, the more you see systems get larger and larger and have their own rational for things that seem insane to an outsider. Maybe microsoft.com is running on an ancient Windows 2000 server and they've forgotten the admin password. You'd think that could never happen at a company like Microsoft (or maybe you would), but you'd be surprised.
