Microsoft announced plans back in 2023 to unify its cloud services under a single domain. The reason was simple: enhance security, streamline the user experience and simplify administrative tasks.
The process is ongoing and Microsoft announced recently that the next phase of the transition begins in July 2026. The plan is to migrate the OneDrive and SharePoint services, including their domains, to the cloud.microsoft domain. Microsoft hopes to complete the migration by June 2027.
According to Microsoft, the process happens automatically in the background. Users will be redirected to the new domain automatically. It can happen, however, that some users, even in the same organization or network, are redirected earlier than others.
To understand this shift, it helps to realize how fragmented Microsoft’s web address ecosystem has been. For years, users have had to hop between a massive web of completely different domains like office.com, teams.microsoft.com, sharepoint.com, and outlook.office365.com.
The core of this update is a massive cleanup effort. Microsoft is progressively moving all of its core 365 web apps into a single, unified home: *.cloud.microsoft.
Why is Microsoft doing this?
This isn’t just a cosmetic makeover. Moving everything under a single domain solves three major architectural headaches for Microsoft:
- Better Security: Because Microsoft owns and directly runs the top-level domain .microsoft (unlike .com, which anyone can buy a variation of), it creates an incredibly secure sandbox. It makes phishing, domain spoofing, and “lookalike” malicious websites virtually impossible to pull off for these services.
- Smoother Performance & Fewer Logins: Right now, as your browser hops from outlook.office.com to sharepoint.com, it constantly has to pass security tokens back and forth across different domains to keep you signed in. Consolidating into one domain cuts down on redirect loops, reduces “sign-in fatigue,” and speeds up app switching.
- Easier IT Management: Network admins used to have to manage massive, ever-evolving lists of dozens of domains to let Microsoft 365 traffic through company firewalls. Now, they can eventually just whitelist *.cloud.microsoft.
For users, the most important information is that bookmarks and links are safe, and that redirects will happen automatically.
So, doing the opposite of something just like 2FA is more secure is it? Single auth point, fewer attack vectors? 🤔
At long last – someone at M$ applying some common sense!