Is this a legit e-mail from Microsoft?

Question

Can someone tell me if the below e-mail is legit?  I can't find the sender's address as a legit one for Microsoft, but I've seen similar ones that are legit.

From: Microsoft Office 365 <******@business-microsoft.com>

Sent: Friday, January 24, 2020 2:14 PM

To:

Subject: Unusual Sign-in Attempt On Your Microsoft Business Account

We detected something unusual about a recent sign-in attempt in your Microsoft Office 365 Business account - this may have been you signing in from a new location, device, or app.

Sign-in details:

Country/region: Russia

IP address: 138.166.42.119

Date: Monday 3:06 PM (GMT)

Platform: Windows

Browser: Firefox

Please use the following validation link to avoid the Microsoft account termination policy.

Validate Account

Thanks,

The Microsoft account team

The information contained in this email is intended only for the use of the person or entity to whom it is addressed and may contain information that is confidential and exempt from disclosure under applicable laws. If you read this message and are not the addressee, you are notified that use, dissemination and reproduction of this message is prohibited. If you have received this message in error, please notify the sender immediately and delete this message from your system.

Answer 1

Hello HeatherM

While MS certainly does send out alerts about suspicious activity, the line

>>

Please use the following validation link to avoid the Microsoft account termination policy. Validate Account

<<

indicates that this is a phishing scam to get your credentials. A legit alert would tell you to review the sign-in activity on your account and proceed from there. It would NOT ask you to "validate" your account.

Without seeing the actual URL that "Validate" points to, will bet that it doesn't point to a legit MS URL. Easy enough to check, hover your mouse over the link and see where it actually points to OR right-click on that link --> select <Copy> and paste it into any text editor (i.e. Notepad). As for the "sender's address" - that's far too easy to "spoof" to make it look legitimate.

How to check your sign in activity

Check the recent sign-in activity for your Microsoft account

https://support.microsoft.com/en-ca/help/402664...