This is not a problem for my usage. I have local dns records of devices set within the web interface to tell my traffic apart, and already know which of them are set to automatically use pihole through client -> router -> pihole and which are manually configured use unbound/pihole through device settings.
Most are configured manually, this mainly for people visiting and using the wifi, i would like them to use pihole as well. When i say "it's coming from my router" that doesn't mean it's coming from either of 5 different devices in my case, because i don't have it set up like that currently. I know (x) IP means this traffic is from my phone and (y) is from my computer, ect. This is not the issue. I can still guess to know from what device it's coming from by deduction.
Besides, I have already narrowed it down to it phone and router by shutting everything else off, it keeps going. Where is this www.microsoft.com query coming from?