The hidden risk of using aka.ms shortURLs for Microsoft portals

We all love them: Microsoft’s short URLs at aka.ms. The aka.ms domain is owned by Microsoft and is used to shorten URLs for many purposes. I even got one myself that points to my MVP profile. They are usually pointing to documentation, which is fine, but they are also used for Entra or Microsoft 365-integrated portals. Just to name a few examples:

• aka.ms/mfasetup (Security info registration portal)
• aka.ms/ssprsetup (Security info registration portal)
• aka.ms/mcasportal (Defender for Cloud Apps)
• aka.ms/ge (Graph Explorer)
• aka.ms/mfaportal (per user MFA portal)

You’ll also get a feeling of the most used URLs by using the Google search bar:

I also use them frequently, and the other day I typed the wrong domain by accidentally fat-fingering something like akka.ms instead of aka.ms. And that led me to a totally different page. Scary. That got me thinking.

So, I looked up similar domains, and to my surprise, a few of them were unregistered. So I ended up buying these three domains.

I added them to CloudFlare, so I had better flexibility over the domain. So I ended up adding some rules.

This would then basically correct the typo and forward the page to the correct domain, keeping the path intact.

But that got me thinking. These URLs would most likely be used in manuals or provided to the user over the phone, for example, to set up or recover MFA credentials. As these URLs become more common and known to the users, they might be mistyped more often. Imagine an IT helpdesk agent helping someone over the phone. They point them to aka.ms/mfasetup, and they are typing akaa.ms/mfasetup instead.

With these domains in possession, I could basically redirect most of the mistyped aka.ms URLs (worldwide) to a destination of choice. Now, I’m a nice guy with good intentions, so the naughtiest action I could think of would be to redirect them to Rick Astley’s most popular pop song, but imagine what others may do with it. Since the user is expecting a Microsoft sign-in page in most cases, they might easily fall for a phishing attempt.

I have limited traffic information because I’m on the free tier. Stats are from the past 12 hours. Not sure how many of those requests are scanners, but I’ll keep an eye on them.

Web traffic logs from the past 24 hours seem to have some spikes.

To conclude, please be careful when adding aka.ms short URLs to your manuals, or let users type them over the phone.

Stay safe!