Microsoft login URL: the real address
Microsoft has 2 real sign-in addresses. If a link takes you anywhere else and asks for your Microsoft password, close it. We opened each address below on 9 November 2026.
Work or school accounts, including Microsoft 365 and Outlook at work
Personal Microsoft accounts, including Outlook.com, Xbox and OneDrive
Domains Microsoft uses
Not a complete list. Each address below can have subdomains in front of it (www., login.), and they are still Microsoft's.
microsoft.commicrosoftonline.comlive.comoutlook.comoffice.commicrosoft365.com
Real Microsoft domains where anyone can publish
These belong to Microsoft, but the pages on them are made by its customers. A sign-in form here is not Microsoft's sign-in page.
| Address | Why | Live phishing URLs |
|---|---|---|
sharepoint. | Anyone with a Microsoft 365 account can share files and pages on sharepoint.com. | 23 |
onmicrosoft. | Every Microsoft 365 customer gets a name.onmicrosoft.com address, and scammers sign up too. | 0 |
office. | Microsoft Forms links (forms.office.com) can be made by any account holder. | 117 |
Live phishing URLs: any brand, counted in PhishTank's list on 5 November 2026.
How to read the address
Look at the part between https:// and the first single /. Read it from the right. The real thing ends in microsoft.com or another domain listed below, with nothing but a dot before it.
https://login.microsoft.com/…is Microsoft: it ends in.microsoft.com.https://microsoft.com.account-check.example/…is not: it ends inaccount-check.example, and Microsoft's name at the front is decoration.https://microsoft-secure-login.example/…is not: a hyphen makes a different domain, and anyone can register one.
Everything after the first / is chosen by whoever made the page, so …/microsoft.com/signin in the path proves nothing.
What fake Microsoft pages looked like
On 5 November 2026, PhishTank listed 254 live, verified phishing URLs that its volunteers labelled Microsoft.
- 96.9% used HTTPS. The padlock means the connection is encrypted, not that the site is Microsoft.
- 2% had "microsoft" in the hostname. Most fakes give no such clue, so the absence of Microsoft's name doesn't make a link safe either.
- 28.7% sat on services anyone can sign up to, such as website builders, file sharing and QR-code links, rather than on a domain the attacker registered.
Hostnames from the same list that use Microsoft's name without being Microsoft's, newest first. Dots are written as [.] so none of them is a working link.
- microsoftt7[.]vercel[.]app
- microsoft09-one[.]vercel[.]app
- microsoftoutlook[.]flazio[.]online
- microsoftconfig-3[.]vercel[.]app
- connectezvousamicrosoftoutlook[.]weebly[.]com
- microsoft[.]team365[.]realtrade4[.]com
Report a fake Microsoft email or page
In Outlook, select the message and choose Report, then Report phishing. Microsoft's help page gives no email address for this.
Source: Microsoft: Phishing and suspicious behavior in Outlook, checked 9 November 2026.
Lures to watch for
- A real Microsoft sign-in page for your work account can show your company's logo and background, because companies upload their own branding. A logo proves nothing; the address does.
- "Your mailbox is full" and "shared document" emails that open a sign-in page are the most common Microsoft lures. Close the email and open Outlook or office.com yourself.
Not sure about a link? Paste it into the free link checker. It reads the address only and doesn't open the page. The PhishClean browser extension also checks each page you open for signs of a fake sign-in form.
Questions
What is Microsoft's official login URL?
login.microsoftonline.com (Work or school accounts, including Microsoft 365 and Outlook at work); login.live.com (Personal Microsoft accounts, including Outlook.com, Xbox and OneDrive). A real Microsoft address ends in microsoft.com, microsoftonline.com, live.com or another domain the brand owns, read from the right of the hostname.
How do I report a fake Microsoft email or website?
In Outlook, select the message and choose Report, then Report phishing. Microsoft's help page gives no email address for this.
Do fake Microsoft sites use Microsoft's name in the address?
In PhishTank's list of live phishing URLs on 5 November 2026, 5 of the 254 URLs labelled Microsoft (2%) had the brand's name in the hostname, so most gave no such clue. 96.9% used HTTPS, so a padlock proves nothing.
Can a phishing page be on a real Microsoft domain?
Yes. sharepoint.com, onmicrosoft.com, office.com belong to Microsoft, but the pages there are made by its customers, so a sign-in form there is not Microsoft's sign-in page. PhishTank's list on 5 November 2026 held 140 live phishing URLs on these addresses.
How we checked
- Sign-in addresses: opened on 9 November 2026 and followed through every redirect to where the sign-in page loads.
- Phishing numbers: PhishTank's online-valid list, downloaded 5 November 2026. Only URLs its volunteers labelled Microsoft count, and many fakes are labelled "Other", so these are a sample. We didn't open any of them. Data shared under CC BY-SA 2.5; method as in our phishing URL statistics.
- Example hostnames: hostnames in the whole list that contain "microsoft" but aren't on Microsoft's domains, one per domain.
See also: official sign-in addresses of 15 brands.
Last updated: , when the sign-in addresses were checked.