Strange redirect when signing in - phishing?

The redirect itself does not look like a phishing site. admin.cloud.microsoft is a Microsoft domain, and the message on the page explains the likely problem: the browser is currently signed in with a personal Microsoft account that does not have access to the Microsoft 365 business tenant. A page loading with an unusual font can also happen when some page resources do not load correctly; it is not proof of phishing on its own.

That said, the email should not be trusted solely because the button led to a Microsoft domain. Do not use the email link again. Open a private/InPrivate browser window, go directly to https://admin.microsoft.com, and sign in with the work or school account that owns the Business Standard subscription or has a Billing Administrator/Global Administrator role. Then check the payment status under Billing in the admin center.

If the wrong account keeps being selected, sign out of Microsoft accounts in that browser, close all Microsoft 365 tabs, and try again in a private window. This avoids an existing personal-account session being reused automatically.

If the email sender, invoice number, and declined payment do not match what appears in the admin center, treat the email as suspicious and report it as phishing. If any password, card information, or verification code was entered after following the email, change the account password, revoke active sessions, and contact the card provider promptly.

Treat the email and the sign-in loop as two separate checks. For the email, do not use the button again; go directly to https://admin.microsoft.com or https://portal.office.com in a new InPrivate window and check Billing from there. For the redirect, `admin.cloud.microsoft` can be a Microsoft domain, but the repeated `UnAuth` loop usually means the signed-in account does not have the expected admin role or the browser is holding a stale work-session cookie. Sign out of all Microsoft sessions, close the browser, then sign in with the tenant admin account only. If Billing still shows a problem, open the support request from the admin center and include the timestamp and error code, not the email link.

Ok thanks.  Surprised they would use a strange domain like .microsoft.  I was trained to be suspicious of these.  

Anyway, when I go to admin.microsoft.com I now get redirected to this page as well.  But when I click on the 'Sign out and login with a different account' button it directs back to the login page for a split second and then automatically back to this page.  So I am in an infinite loop and can't login anymore.

And I can't raise a ticket because I can't get into admin centre now.

Would suggest direct login to M365 Admin Center and check the bill, learn.microsoft.com/en-us/microsoft-365/admin/admin-overview/admin-center-overview?view=o365-worldwide

The redirect itself is legitimate: cloud.microsoft is an official Microsoft-owned domain, .microsoft is controlled by Microsoft, and admin.cloud.microsoft is the documented Microsoft 365 admin center. The error does not by itself indicate phishing. However, that does not prove the email was genuine, because a message can link to a legitimate site or misrepresent a billing issue. Do not use the email button again. Open a new browser window, enter the admin center address manually, and check Billing, Your products, payment status, and Service health. Report the message as phishing if those records do not match its claim. If you entered credentials or approved MFA after clicking, change the password, revoke active sessions, inspect Entra sign-in logs for unfamiliar activity, and check for added authentication methods or inbox rules. If the portal still loops, use Microsoft 365 support and include error code 100014.