No, of course the MS CA (that is, the Certificate Authority server software in Microsoft Windows Server) doesn't generate a private key for you! That would be a terrible security design!
The MS CA uses special HTML tags (that were originally MS-proprietary but are now widely supported) to tell the client web browser to generate a key pair and to send just the public key to the MS CA. The MS CA uses that public key, plus the identity information the server already knows about the account you used when logging into the MS CA's web UI at the
/certsrv URL, to generate a public key certificate for you, and to make that new cert (and the CA certs in the trust chain) available for download.
When your browser sees the special HTML tags and generates the key pair, it stores the private key somewhere locally on the client machine. For MSIE on Windows, that would be in the "Microsoft Certificate Store" (read the word "Store" as "Storage", not "Retail Shop" :). For Safari on the Mac, that would be in the Mac Keychain. Other browsers may choose to use their host OS's built-in features for secure storage of the private key, or they may implement their own way to securely store private keys.
After you download the newly issued cert, you probably need to install it into the same secure storage area that your browser put the matching private key when it generated it. So on the Mac, you'd need to import that cert into the Keychain. I believe MSIE for Windows has an ActiveX control or other browser plug-in or built-in functionality that automatically downloads the public key certificate and installs it into the Microsoft Certificate Store on the client machine.
[Caveat lector: I haven't messed with this stuff on Windows-based systems in years (like the Windows XP and Windows Server 2003 era), so this information may be terribly out of date. Hopefully someone with more recent knowledge of how this works in Windows-based systems can correct me.]