Microsoft 365 tenant

When a company uses Microsoft 365, Microsoft publishes a small amount of public information about the tenant: a globally unique ID, whether sign-ins are managed in the cloud or federated to an internal server, and sometimes the tenant's built-in onmicrosoft.com name. Attackers use these same lookups to pick targets, so knowing what your domain exposes is useful.

The onmicrosoft.com name is the default mailbox domain (for example, yourname at tenant.onmicrosoft.com). It is not always discoverable publicly, and a missing result here does not mean Microsoft 365 is misconfigured.