I have been getting emails from "email@example.com" (as verified in metadata) about unusual activity. The internet has very conflicting information about if these emails are legitimate or not. Microsoft's own website says this is their legitimate sender address for account activity alerts.
A legitimate email message should originate from the Microsoft account team at firstname.lastname@example.org.
But here, the Georgia College help desk lists this exact email, from that exact sender address, as a phishing attempt.
Many people at GC are receiving one of the more popular phishing scam emails. It appears to be from Microsoft, a “Security Alert” wanting you to revalidate your account. Know that this is not from Microsoft. It’s a very elaborate phish. Do not click on any link in this email. Please delete it. If you did click on the email, please reset you Unify password (and subsequent email password) at password.gcsu.edu.
From: Microsoft account team email@example.com
Sent: Monday, April 3, 2017 3:36 AM
Subject: Microsoft account security alert
Other places online have similarly conflicting info. Some places list these emails as scams, but the example screenshot has a different sender address that is missing the "microsoft.com" from the domain, which looks more fake.
So which is it? Are those emails from exactly "firstname.lastname@example.org" fake, or not?