If you've stumbled upon enterpriseenrollment.starbucks.com.tw, you might expect a Starbucks corporate portal. Instead, the site presents a serious red flag: its SSL certificate is issued to Microsoft, not Starbucks, and the page redirects to Microsoft's Intune enrollment service. That's a strong sign this subdomain is misconfigured—likely pointing to the wrong server. While the parent domain starbucks.com.tw is legitimately owned by Starbucks, this subdomain isn't properly set up for use. For a service that could handle employee or device enrollment, a valid certificate matching the site's name is non-negotiable. Without it, any data you enter could be intercepted or misrouted. Our advice: steer clear until Starbucks fixes this. If you need to manage enterprise enrollment, go directly to Microsoft's official Intune portal. There's no evidence of malicious intent here, but the broken configuration makes this site untrustworthy.
No — enterpriseenrollment.starbucks.com.tw doesn't look safe
In plain English
This subdomain is almost certainly a misconfiguration rather than a scam, but it's not safe to use. The SSL certificate is for Microsoft, not Starbucks, and the site redirects to Microsoft's Intune portal. Until the certificate and redirect are fixed, avoid entering any information here.
What you should do now
Don't panic. These steps limit the damage, and the sooner you take them the better.
Don't enter any details
No passwords, card numbers or personal information — even if the site looks professional.
Close the tab
Especially if you got here from an email, text message or social media ad.
Already paid? Call your bank
Contact your bank or card provider right away. They can often stop or reverse a recent payment.
Warn others
Report the site and share this check with anyone who sent you the link.
Where the score comes from
The SSL certificate is invalid and belongs to Microsoft, not Starbucks. This is a critical failure for any site handling logins.
The parent domain is clearly owned by Starbucks Corporation with a long history and reputable registrar. The subdomain appears to be a misconfiguration rather than a fake.
No blacklist hits or Google Safe Browsing flags, but the site has no web archive history, which is unusual for a business subdomain.
The site lacks basic branding like a favicon and contact information. For a service that likely handles enrollment data, this opacity is concerning.
No privacy policy or terms of service found. A site collecting enrollment data should have clear legal pages, especially under a major brand.
DNS resolution works but the SSL certificate mismatch and redirect to Microsoft indicate poor server configuration. DNSSEC is not enabled.
What we checked
Think this verdict is wrong?
Site owners can request a fresh scan. Scores update automatically as signals change.