From the article:

Microsoft’s records showed that at that exact same minute, a Windows device carrying GDID g:6755467234350028 had visited the ngrok signup page.

Seems pretty clear to me. Microsoft tracked acces to an independent sign up page using the GDID.