The normal CVE rules for duplication would say to prefer the Microsoft-generated candidate, since it was more authoritative than the original announcement, which was not coordinated with Microsoft.
The older candidate had been out for a few months, and since the issue was well known, the older candidate was probably in heavy use.