Azure Action group email OTP page looks like a device code flow phishing attempt

Question

Azure Action group email OTP page looks like a device code flow phishing attempt

Pieter Jan Coeckelbergh 30

Hi,

I've gotten an email verification for adding an email address to an action group in Azure. Altough the email is sent from a well known email address [email protected], the URL in that mail feels more like a phishing attempt then a real microsoft product:

URL is https://userlinks.azns.microsofticm.com/ which apparently is an internal microsoft product not a well known microsoft public url like portal.azure.com. This URL isn't mentioned in any docs related to the recent email validation change.
UX of that page looks like it was made in a hurry and doesn't align with the quality of a microsoft product.

User's image

Please confirm if this is the actual OTP url and page and modify, document etc. so this doesn't look like a phishing attempt. It's 2026 Microsoft, we can't have solutions go live like this.

Megan OConnor 65 Reputation points

2026-09-16T18:05:42.5933333+00:00

Following as have same Q. This url was flagged by our internal monitoring, and even though I can show them from the cert it does belong to Microsoft, would also like to have some sort of official documentation of this endpoint in case any further questioning.
Boers IT Consulting 0 Reputation points

2026-10-27T18:34:29.83+00:00

Who thinks it's a good idea to ship this? It looks like a poorly crafted phishing page. I'm sure Beef (Browser Exploitation Framework) makes better UI than this...

Answer accepted by question author

Alex Burlachenko 26,695 MVP Volunteer Moderator

Hi Pieter Jan Coeckelbergh & thx for join me at Q&A platform, I agree with your concern. A verification email pointing to an unfamiliar domain, combined with a page that doesn't resemble the usual Microsoft authentication experience, is exactly the kind of thing security awareness training tells users to question.

Microsoft's Azure Monitor Action Groups documentation confirms that new email recipients must complete OTP verification within 30 minutes. It also lists [email protected] as a legitimate notification sender.

However, I couldn't find an official Microsoft reference explicitly confirming userlinks.azns.microsofticm.com as the verification endpoint. So I wouldn't claim the URL is verified solely because the email sender and page design look plausible.

This is also different from a Microsoft Entra device-code sign-in flow. The page requests an email verification code, not a device authentication code, although the unfamiliar domain creates a similar phishing concern.

I'd recommend that the Azure Monitor team explicitly document the verification domain and link it from the Action Groups documentation. That would help customers validate the endpoint and allow security teams to review it without relying on assumptions.

Until Microsoft confirms the exact URL, users should verify that they actually initiated the Action Group change and avoid entering codes from unexpected emails

rgds,

Alex

p.s. if my answer is help - pls mark it as an answer

0 comments

1 additional answer

Your answer

Megan OConnor 65 Reputation points

2026-09-16T18:05:42.5933333+00:00

Following as have same Q. This url was flagged by our internal monitoring, and even though I can show them from the cert it does belong to Microsoft, would also like to have some sort of official documentation of this endpoint in case any further questioning.
Boers IT Consulting 0 Reputation points

2026-10-27T18:34:29.83+00:00

Who thinks it's a good idea to ship this? It looks like a poorly crafted phishing page. I'm sure Beef (Browser Exploitation Framework) makes better UI than this...

Answer 1

Boers IT Consulting 0

Its verified. I was hesitant, but after clicking RESEND from Azure myself and seeing the email appear in my inbox the same minute i felt confident enough to proceed. After entering the code my email was verified.

so it’s legit, just ugly and bad practice

0 comments