What is aka.ms - BioErrorLog Tech Blog

aka.ms is a URL shortener officially operated by Microsoft.

Introduction
What is aka.ms?
Is aka.ms really issued by Microsoft?
- The domain is owned by Microsoft
- Only Microsoft can create shortened URLs
Conclusion
References

Introduction

If you've ever read Microsoft's official documentation or blog posts, you've probably come across URLs in the format aka.ms/xxxxx.

A quick search reveals that this appears to be a URL shortening service run by Microsoft, but there doesn't seem to be any official Microsoft documentation explicitly stating so.

In this article, I'll clarify what aka.ms is and whether it truly is a URL issued by Microsoft.

Note: This article was translated from my original post.

What is aka.ms?

aka.ms is a shortened URL service operated by Microsoft.

It's widely used as a shortcut to various Microsoft services and documentation.

Examples:

https://aka.ms/vscode: Download page for Visual Studio Code
https://aka.ms/winget: GitHub repository for winget

Now let's look at the evidence that aka.ms is genuinely operated by Microsoft.

Is aka.ms really issued by Microsoft?

To confirm that aka.ms is issued by Microsoft, we can examine two key aspects:

The domain is owned by Microsoft
Only Microsoft can create shortened URLs with it

Let's go through each one.

The domain is owned by Microsoft

First, Microsoft's official GitHub hosts a repository that maintains a list of public aka.ms links:

github.com

The fact that Microsoft manages a collection of aka.ms links on their own GitHub is one piece of evidence that aka.ms belongs to Microsoft.

Next, let's verify this more technically.

We can check the SSL certificate for aka.ms using the following commands:

$ echo | openssl s_client -connect aka.ms:443 -servername aka.ms 2>/dev/null | openssl x509 -noout -subject -issuer 
subject= /C=US/ST=WA/L=Redmond/O=Microsoft Corporation/CN=go.microsoft.com
issuer= /C=US/O=Microsoft Corporation/CN=Microsoft TLS G2 RSA CA OCSP 16

$ echo | openssl s_client -connect aka.ms:443 -servername aka.ms 2>/dev/null | openssl x509 -noout -text | grep -A1 "Subject Alternative Name"
            X509v3 Subject Alternative Name: 
                DNS:go2.microsoft.com, DNS:go.microsoft.com, DNS:www.aka.ms, DNS:aka.ms, DNS:fast.go.microsoft.com

When connecting to aka.ms, the certificate returned is issued to Microsoft Corporation (located in Redmond, Washington).

During SSL certificate issuance, the Certificate Authority (CA) verifies the organization's identity, which means a third party cannot obtain a certificate under the name Microsoft Corporation. This confirms that Microsoft manages the servers behind aka.ms.

It's also worth noting that the certificate issuer is a Microsoft Corporation intermediate CA. Microsoft operates its own certificate authority for its services, which is why both the subject and issuer are Microsoft.

Furthermore, looking at the certificate's SAN (Subject Alternative Name), we can see that aka.ms, go.microsoft.com, go2.microsoft.com, and fast.go.microsoft.com are all included in the same certificate.

To list multiple domains in a SAN, you must prove ownership of all those domains to the CA. This means aka.ms and the go.microsoft.com family of domains are managed by the same organization, confirming that aka.ms runs on the same infrastructure as Microsoft's go.microsoft.com domain.

From the above, we can confirm that the aka.ms domain is owned by Microsoft.

Only Microsoft can create shortened URLs

Next, let's verify that only Microsoft can create aka.ms shortened URLs.

For this, we'll look at statements from former Microsoft employees.

On a Microsoft blog, there's an article by a former Microsoft employee that states:

Note, although it's not a public service (short URL creation is internal), but once they're created, these short URLs are available externally.

In other words, creating shortened URLs is an internal process and not a public service — third parties cannot create them.

Next, let's look at a blog post by Microsoft employee Ben Wyatt:

Working at Microsoft, there are lots of links to keep track of. To make this "easier," we tend to use the internal link shortener, aka.ms, and hand out those URLs for everything.

He describes aka.ms as "the internal link shortener," making it clear that this is not a URL shortening service available to the general public.

Based on these statements from Microsoft employees, we can conclude that aka.ms is not a public URL shortening service like t.co or bit.ly — it's a shortened URL service that can only be used internally at Microsoft.

Conclusion

We've confirmed that aka.ms is a shortened URL service owned and operated by Microsoft.

Since only Microsoft can create these shortened URLs internally, aka.ms links can be trusted as official Microsoft links.

That said, phishing emails may still use lookalike domains that resemble aka.ms (e.g., aka.rns, aka-ms.com). Always make sure the domain is exactly aka.ms.

[Related articles]

en.bioerrorlog.work