Suspicious Login Issues

How to Report a Suspected Cloned Microsoft 365 Tenant Email

Amos Gikunda Oct 7, 2026 868 views

Question details

The user received a genuine-looking email from Microsoft regarding a 'CLONED' tenant and needs to know how to verify and report it.

How to Report a Suspected Cloned Microsoft 365 Tenant Email

Product: Microsoft 365
Device & OS: not provided
Scenario: Receiving an unexpected email about enabling security defaults for an unfamiliar tenant, even though the recipient did not create a Microsoft account or tenant.
Observed behavior: The email requests the user to enable security defaults for a tenant starting with 'CLONED'. The sender address appears legitimate, but the users involved have no association with this tenant.

Before you start

Do not click on any links, open attachments, or reply to the suspicious email. Treat any unexpected security alert regarding an unknown tenant as a potential phishing attempt until verified.

Solution 1Recommended

Identify and Report the Phishing Attempt to Microsoft

Use this method to safely handle the suspicious email without compromising your personal information and officially report it to Microsoft security.

A legitimate-looking sender address is easily spoofed and does not prove the email is genuinely from Microsoft. Microsoft 365 tenants are typically used for business or education accounts, so receiving this on a personal email without an associated account is a major red flag.

Do not click any embedded links

Avoid interacting with any buttons such as 'Enable Security Defaults' or 'Sign In'. These links are designed to steal your credentials or distribute malware.

Use the built-in report feature

If you are using Outlook, select the suspicious email, go to the Home tab, and click the 'Report Message' or 'Report Phishing' button on the ribbon. This directly notifies Microsoft.

Forward the email to Microsoft

If you are using a different email client, create a new email and forward the suspicious message as an attachment to phish@office365.microsoft.com.

Delete the email

Once you have successfully reported the message, delete it from your inbox and clear it from your 'Deleted Items' or 'Trash' folder.

Identify and Report the Phishing Attempt to Microsoft

Stay Protected: Reporting phishing helps Microsoft improve their spam filters and protect other users from receiving similar fraudulent tenant emails.

Solution 2

Verify Your Account Security Settings

Take proactive steps to ensure your existing email accounts have not been compromised by similar phishing attacks.

Free Microsoft Office alternative

Try WPS Office as a Secure and Hassle-Free Alternative

If you are tired of complex tenant management, subscription fees, and targeted security threats in Microsoft 365, WPS Office offers a powerful, offline-friendly alternative. It is highly secure, lightweight, and doesn't require complicated organizational tenant setups for individual users.

1. Download the installer: Visit the official WPS Office website and click the free download button for your operating system.
2. Install the software: Run the downloaded installer file and follow the straightforward on-screen instructions.
3. Start creating safely: Open WPS Office to instantly edit your Word, Excel, and PowerPoint files without worrying about complex tenant logins.

100% free to use with no mandatory cloud tenant configurations.Seamlessly compatible with Microsoft Office formats like DOCX, XLSX, and PPTX.Lightweight software that installs quickly and runs smoothly on all devices.Familiar tabbed interface makes migrating from Microsoft Office effortless.

Frequently Asked Questions

Why did I receive a Microsoft 365 tenant email if I don't have an account?

Scammers send these emails in bulk to randomly generated or leaked email addresses. Their goal is to create panic and trick you into clicking a malicious link, regardless of whether you actually own a Microsoft account.

What does a 'cloned tenant' mean in Microsoft 365?

A tenant is an organization's dedicated instance of Microsoft 365 services. A 'cloned tenant' in the context of phishing usually refers to a fake environment set up by scammers to mimic a legitimate organization and deceive users into handing over credentials.

Can scammers spoof a legitimate Microsoft email address?

Yes, cybercriminals can use techniques like email spoofing to make the 'From' address look exactly like a genuine Microsoft support email. Always check the actual email headers or look for other red flags rather than relying solely on the display name.

Is my device infected if I just opened the email?

Simply opening and reading a text-based email is generally safe on modern platforms. The danger arises if you click on embedded links, download attachments, or reply with personal information.

Microsoft Office Security Issues