Many organisations train their personell with phishing attempts from domains that are different from the one the organisation uses.
The mantra is: only respond to emails (or clicking links in them) from domains you know.
Microsoft sent (still sends?) account expiration emails for various *.microsoft.com, *.visualstudio.com and other Microsoft domains like this:
[Wayback/Archive] 232840055-2ccfdb9b-2a13-4a34-92f5-f27f337825f8.png (766×653) email from
Microsoft account team <account-security-noreply@mail.msa.msidentity.com>
The Wiert Corner - irregular stream of stuff 