Tip: treat AI-branded 'event RSVP' pages that demand Microsoft or Google work SSO as phishing until you verify the URL on the vendor's real site
Open the vendor's real events or academy page yourself (type the domain; don't follow the invite). If the livestream or briefing isn't listed there, stop.
Never complete a Microsoft device code prompt that appeared right after an email or short-link 'RSVP'. Real Microsoft device login is for apps you started, not for claiming event swag.
Watch for Cloudflare bot checks and brand-new domains (eventrsvp[.]app, *rsvp*, lookalike webinar hosts) in front of AI-branded rewards.
If someone already approved a device code or signed in: revoke sessions, reset the password, review OAuth app consents, and rotate any tokens minted in that window.