I recently received an email from Microsoft stating that I needed to make a purchase to keep my account alive. It has all the hallmarks of a phishing scam: immediate request, account closure, demand for payment… yet it’s actually from Microsoft.
So, what gives? Why does Microsoft promote security yet send emails that look and sound like they’re about to steal your account and money?
What Is the Microsoft “Entra ID Inactive” Email?
A few days back, I received an email from Microsoft regarding an inactive Microsoft Entra ID tenant. The email subject line was “Action required: Make a purchase by August 11, 2025 to continue using your tenant,” and the email body states that to continue using my tenant, I must “make a purchase before August 11, 2025.”
Now, I have no idea what a Microsoft Entra ID tenant is. I’ve never heard these terms together, and certainly don’t understand why I should make a payment to keep whatever it is active (so my phishing and scam alarm bells are already beginning to whir into action).
After a cup of tea and a few internet searches, I tracked down what an Entra ID tenant is, because I had no idea. An Entra ID tenant is your unique identification within a Microsoft Entra organization. Entra was known as Microsoft Azure until 2023, when Microsoft rebranded, but effectively covers anything relating to Azure Active Directory, Microsoft 365 for Businesses, and so on.
So, after some more noodle-scratching, I remember that I’d set up a basic Active Directory account years ago when messing around with some virtual machines. This is very likely why I received this email—I actually have an Entra ID tenant that’s about to be blocked.
This is no problem for me, as I don’t use Entra ID, Active Directory, or otherwise. But if you have received this email and do actively use those tools, it may well be worth extra investigation. Either way, it appears that my Entra ID is already blocked, long before the stated cut-off date.
Microsoft’s Email Looks Like a Phishing Scam
Confusing language aside—that’s on me for not keeping up with Microsoft’s changes to Azure—Microsoft’s email is full of red flags for phishing. The red flags I regularly warn people about when they wonder how to spot phishing emails.
- An email was sent to you out of the blue regarding a service you don’t remember signing up for.
- The email demands immediate action, specifically a payment, to keep your account active.
- Hovering over the Make a purchase button displays a long, random-looking URL. It has the word “Azure” in it, but it’s a confusing string to read.
It’s a confusing approach from Microsoft. There is no information on what the Entra ID is, and the language used is suspicious. For a company deeply integrated into cybersecurity, it should know better!
Related
If You Think You Can Spot Phishing Emails, Take This Quiz
Why not brush up your skills and make sure you know how to spot phishing scams.
So, the Microsoft Entra ID Email Isn’t a Scam?
The email I received wasn’t a scam. The Microsoft email comes from the real Microsoft domain, and despite it looking suspicious, everything eventually checked out.
If you have received this email and cannot figure out if you’re using Azure/Entra, there are a couple of steps you can take.
- Head to your Microsoft Account Active Subscriptions. From here, you can see any active subscriptions on your Microsoft Account and make changes accordingly.
- You could try to access your Entra ID and make changes from there. However, as said, my ID is already blocked, so that option wasn’t available to me.
However, note that just having an Entra ID isn’t necessarily a problem. You won’t be charged just for having an unused or blocked Entra ID, and if you don’t activate it, Microsoft will just delete it and move on without issue.
The Entra ID email is a warning that something is going to happen and not—as I initially thought—a well-crafted phishing email designed to steal your data!