I establish trust via the autofill of my password manager. If my password manager doesn't offer a list of my Microsoft accounts for autofill, it's probably not a Microsoft website.

Yes, this is not bulletproof, because some companies have login pages on multiple domains. But at least it fails safely and causes me to become cautious when that happens.