Whether you are managing AWS EC2 instances, an Azure subscription, or Google Cloud projects, getting to the right console quickly matters. But it matters even more that you reach the real console. Attackers routinely register lookalike domains and buy search ads that impersonate cloud sign-in pages to harvest credentials. This guide lists the canonical login URLs for the major providers and explains how to use them safely.
The canonical sign-in URLs
Below are the official console and admin URLs. Bookmark these directly rather than searching for them each time.
- AWS Management Console —
https://console.aws.amazon.com/ - AWS account-specific sign-in —
https://<account-alias-or-id>.signin.aws.amazon.com/console - Microsoft Azure portal —
https://portal.azure.com/ - Microsoft Entra admin center (formerly Azure AD) —
https://entra.microsoft.com/ - Google Cloud console —
https://console.cloud.google.com/ - Microsoft 365 admin center —
https://admin.microsoft.com/ - Google Workspace admin console —
https://admin.google.com/ - Oracle Cloud (OCI) console —
https://cloud.oracle.com/ - DigitalOcean control panel —
https://cloud.digitalocean.com/
AWS: root vs. IAM sign-in
AWS has two distinct ways to log in, and the difference is important.
The root user signs in at https://console.aws.amazon.com/ using the email address tied to the account. Root access should be reserved for a small set of tasks (such as closing the account or changing the support plan) and protected with a hardware MFA key.
IAM users and account aliases sign in through the account-specific URL: https://<account-id>.signin.aws.amazon.com/console, or a friendlier alias such as https://acme-prod.signin.aws.amazon.com/console. You can set the alias under IAM dashboard settings, which makes the URL easier for a team to remember. Most organizations, however, no longer use long-lived IAM users at all and instead route access through AWS IAM Identity Center (the successor to AWS SSO), which provides a per-organization start URL like https://<your-org>.awsapps.com/start.
Azure and Microsoft 365
The Azure portal at portal.azure.com handles infrastructure: virtual machines, networking, storage, and resource groups. Identity management has moved to the Microsoft Entra admin center at entra.microsoft.com, while tenant-wide configuration of users, licenses, and Microsoft 365 services lives in the Microsoft 365 admin center at admin.microsoft.com. All three authenticate against the same Microsoft Entra ID tenant, so a single set of credentials and MFA covers them.
Google Cloud and Google Workspace
Google keeps infrastructure and organization administration separate as well. The Google Cloud console at console.cloud.google.com is where you manage Compute Engine, Cloud Storage, IAM roles, and billing. The Google Workspace admin console at admin.google.com manages users, groups, devices, and email for your domain. Both use your Google identity, and an organization can federate that identity with an external provider.
Why the exact domain matters
Phishing kits that imitate cloud login pages are common because the payoff is high: a stolen set of admin credentials can expose an entire environment. The defenses are straightforward but require discipline.
Verify the domain every time
Before you type a password, confirm the address bar shows the correct, fully spelled domain ending in the official suffix — amazon.com, microsoft.com, azure.com, or google.com. Watch for subtle substitutions such as arnazon, rnicrosoft, or extra words bolted onto a legitimate-looking subdomain (for example, aws-console-login.example.com). The visible text of a link can differ from where it actually points, so hover to inspect the real destination, or paste suspicious links and senders into a tool like our phishing email analyzer before acting on them.
Reach consoles from bookmarks, not search
Do not Google "AWS login" and click the first result. Paid search ads and SEO-poisoned pages have impersonated cloud sign-in screens. Navigate from a saved bookmark or by typing the known URL directly. If you ever need to confirm who owns a domain you have been sent to, a quick WHOIS lookup can reveal a recently registered, throwaway domain.
Use SSO and enforce MFA
The strongest control is to stop signing in to each console separately. Federate access through a single identity provider (Microsoft Entra ID, Okta, Google, or AWS IAM Identity Center) so users authenticate once, against one trusted domain, with multi-factor authentication enforced centrally. Phishing-resistant MFA such as FIDO2 security keys or passkeys defeats credential-replay attacks even if a user is fooled into entering a password on a fake page.
Organizing console access for teams
For IT teams and MSPs juggling many tenants, a little structure goes a long way:
- Group bookmarks by client or environment (production, staging, sandbox) rather than by provider, so the whole context for an engagement is in one folder.
- Record the account ID, alias, and start URL for each tenant in your documentation or password manager, since AWS and SSO URLs are account-specific.
- Prefer the SSO start URL over per-account console links wherever Identity Center or a third-party IdP is in place — it is one less domain to verify.
- Restrict root and global-admin accounts to break-glass use, store their credentials in a vault, and protect them with hardware keys and strong, unique passwords. You can gauge password quality with our password strength checker.
Quick reference
| Provider | Console / Admin URL |
|---|---|
| AWS Management Console | console.aws.amazon.com |
| AWS account sign-in | <alias>.signin.aws.amazon.com/console |
| AWS IAM Identity Center | <org>.awsapps.com/start |
| Azure portal | portal.azure.com |
| Microsoft Entra admin | entra.microsoft.com |
| Microsoft 365 admin | admin.microsoft.com |
| Google Cloud console | console.cloud.google.com |
| Google Workspace admin | admin.google.com |
| Oracle Cloud (OCI) | cloud.oracle.com |
| DigitalOcean | cloud.digitalocean.com |
Bookmark the consoles you use, verify the domain before every sign-in, and route access through SSO with MFA. Those three habits eliminate the most common way cloud credentials are stolen. For more browser-based security and networking utilities, see our full tools library.