They don’t have to do that at all. These are “Work or School” accounts, and generally with Schools they are on a specific education products on top of that. All they have to do is make the company/school enter ages for all their accounts if they are using EDU products. Microsoft can reasonably trust that data.