How to spot a fake Microsoft 365 login page

Why fake Microsoft pages are everywhere

Microsoft 365 holds a business's email, files, Teams chats and often access to other systems. One work password can open all of it, which makes the Microsoft sign-in page the most copied login screen in the world. Phishing kits sold online produce near-perfect copies, complete with your company's logo and background if it's been configured in your tenant. Staff see the real sign-in page so often that a copy doesn't look out of place. That familiarity is the problem. People type their password almost automatically when the blue-and-white box appears, without checking where they are.

How staff end up on the fake page

The usual route is an email saying someone has shared a document, a voicemail is waiting, a fax has arrived, a password is about to expire or storage is full. Others come from a supplier's genuinely hacked mailbox, sharing an 'invoice' or 'statement' through what looks like OneDrive or SharePoint. Some arrive as PDF or HTML attachments, or QR codes, which skip email link scanning.

The link often passes through legitimate services first, such as a well-known file-sharing site, survey tool or redirect, before landing on the fake page. That makes the first part of the journey look trustworthy and helps the message get past filters. Timing matters too. These emails often land early in the morning, late on a Friday or during busy periods, when people are clearing their inbox quickly. A message that would look odd after a coffee can slip through at the end of a long day, which is why a consistent habit of checking the address bar matters more than relying on spotting something wrong.

Checking the address bar

Real Microsoft 365 sign-ins happen on Microsoft domains, most commonly login.microsoftonline.com, and you'll often pass through other Microsoft addresses on the way. If the address bar shows anything else, whether a random domain, a lookalike like rnicrosoft or a site hosted on a free website builder, close it. Check the domain carefully by reading back from the first single slash. A fake page might use an address such as login.microsoftonline.com.secure-docs.app, where the real domain is secure-docs.app. A padlock means nothing here, because scam sites have valid certificates too.

Other clues that the page is fake

Fake pages sometimes already show your email address, filled in from the link, and jump straight to asking for a password. That's convenient for the scammer but unusual if you didn't start the sign-in. Some show a generic Microsoft page even though your company normally sees its own branding, or the reverse. Another strong clue is your password manager. If it normally fills in your Microsoft password automatically but doesn't offer to on this page, it's because the domain doesn't match. Treat that as a warning, not a glitch to work around by copying and pasting the password.

Why multi-factor sign-in isn't the whole answer

Many people assume that with multi-factor sign-in turned on, a stolen password doesn't matter. Against basic phishing that's true. But more advanced kits act as a relay: they pass your password and your approval through to the real Microsoft page in real time and capture the session that comes back, letting the attacker in without needing the code again. Phishing-resistant methods such as passkeys and security keys defeat this, because they refuse to work on the wrong domain. Conditional access rules that only allow sign-in from company-managed devices also help. These settings depend on your Microsoft 365 licence, so check what your plan includes.

Settings that make fake pages less dangerous

Add your company branding to the Microsoft sign-in page so staff get used to seeing it, and teach them that a page without it is a reason to stop. Enable alerts for sign-ins from unusual locations and for new inbox rules. Block legacy sign-in protocols that skip multi-factor checks. Use email filtering that scans links and attachments, and web filtering that blocks newly registered domains, which phishing sites often are. None of these is perfect alone, but together they turn a successful phish from a quiet takeover into something that's spotted quickly.

If someone entered their password

Reset the password from a trusted device, revoke all sessions, review the multi-factor methods registered to the account and remove any unknown ones. Check the mailbox for new rules, forwarding and sent messages the user didn't write. Review sign-in logs to see whether the attacker got in and what they accessed. If the attacker had access for any length of time, consider who else they may have emailed and whether personal information was exposed. Warning contacts quickly often stops the attack spreading to customers and suppliers.