Forum Discussion
Strange redirect when signing in - phishing?
I just restarted my Business Standard 365 license today and this afternoon got an email from
email address removed for privacy reasons
with the following content:
But when I clicked on the 'Verify payment information' button I am redirected to a page with the following URL:
https://admin.cloud.microsoft/Error/UnAuth?errorCode=100014
looking like this:
This looks highly suspicious (Times New Roman font, URL with no top-level extension such as .com, unusual graphics).
Is this legitimate or a phishing attempt?
Now, when I try to login to admin.microsoft.com to check my account the same suspicious "Sign out and login with a different account" page pops up repeatedly.
4 Replies
Ok thanks. Surprised they would use a strange domain like .microsoft. I was trained to be suspicious of these.
Anyway, when I go to admin.microsoft.com I now get redirected to this page as well. But when I click on the 'Sign out and login with a different account' button it directs back to the login page for a split second and then automatically back to this page. So I am in an infinite loop and can't login anymore.
And I can't raise a ticket because I can't get into admin centre now.
Would suggest direct login to M365 Admin Center and check the bill, learn.microsoft.com/en-us/microsoft-365/admin/admin-overview/admin-center-overview?view=o365-worldwide
When I go to admin.microsoft.com I now get redirected to this page as well. But when I click on the 'Sign out and login with a different account' button it directs back to the login page for a split second and then automatically back to this page. So I am in an infinite loop and can't login to the admin centre anymore.
The redirect itself is legitimate: cloud.microsoft is an official Microsoft-owned domain, .microsoft is controlled by Microsoft, and admin.cloud.microsoft is the documented Microsoft 365 admin center. The error does not by itself indicate phishing. However, that does not prove the email was genuine, because a message can link to a legitimate site or misrepresent a billing issue. Do not use the email button again. Open a new browser window, enter the admin center address manually, and check Billing, Your products, payment status, and Service health. Report the message as phishing if those records do not match its claim. If you entered credentials or approved MFA after clicking, change the password, revoke active sessions, inspect Entra sign-in logs for unfamiliar activity, and check for added authentication methods or inbox rules. If the portal still loops, use Microsoft 365 support and include error code 100014.
