Forum Discussion
Trouble receiving OTP emails from Microsoft Partner Center
Success!
Jill was able to put me in touch with someone that was able to point me in the right direction. It turns out that Microsoft is sending messages from the microsoft.onmicrosoft.com domain.
From: token(at)microsoft.onmicrosoft.com
Subject: Action required: Please verify your email addressIn addition to our organization blocking mail sent from *.onmicrosoft.com domains for security reasons, the messages were apparently being blocked at the M365 perimeter for a period of time because I couldn't even find this in message logs when I first reported the issue back on 1/23/2026.
I didn't see any messages through message tracking in April. However, as of May 28th, they are reaching the message tracking logs!
I suspect the partner center portal was failing to hand the messages off for delivery for a period of time.
In the meantime:
Dear Microsoft,Please update the public documentation to reflect that the partner center sends mail from the domain microsoft.onmicrosoft.com, or send the messages from a domain that is already documented. Here's a list of domains Microsoft says are genuine. The implication being that mail from microsoft.onmicrosoft.com is not genuine.
Can I trust email from the Microsoft account team? | Microsoft Support
accountprotection.microsoft.com
How to determine if an email from Microsoft support is genuine - Azure | Microsoft Learn
Microsoft support uses the following domains to send emails:
microsoft.com
microsoftsupport.com
mail.support.microsoft.com
office365support.com
techsupport.microsoft.comOn a side note, I found the following page while looking to see if anyone has encountered this type of issue before and yes, yes they have.
When Blocking onmicrosoft.com Make An Exception For Microsoft – Denny Cherry & Associates Consulting
Hi everyone! I'm still trying to help microsoft recognize that they are using the microsoft.onmicrosoft.com domain to send legitimate messages. One M365 support engineer suggested that the Azure fraud team was in the best position to assist. But when I tried to get a ticket routed to that team the AI was routing my tickets to the M365 email team instead.
The M365 email team suggested avoiding keywords so the AI case router would stop doing that. When I reached a human and explained the situation they suggested I contact "Microsoft legal" about my fraud concern.
The same Partner Center support engineer told me that the partner center portal doesn't send email so there is no way the message could have come from the partner center and it was not legitimate. I asked her to review this thread because it includes pictures showing how to get the partner center to send an email and also some other resources talking about scenarios the partner center might send emails from other addresses...
The mental gymnastics people are going to in order to avoid addressing this issue is most entertaining!