was getting chrome phising error page ~1h ago. initiated microsoft login with our custom domain, but when it got back from microsoft it went to your slug.oryapis.com or something, not back to our custom domain

Hi @damp-football-37528 This behavior seems odd, did you specify your custom domain as the callback URL at microsoft login? Also did you use https when adding the callback URL to microsoft login?

I do not control the callback URL, its your UI page doing that and getting the oidc callback

Yes the callback is handled by Ory, but the URL still needs to be given to Microsoft. You can swap out the <https://<project-slug>.projects.oryapis.com/self-service/methods/oidc/callback/microsoft> URL with your custom domain https://auth.custom-domain.com/self-service/methods/oidc/callback/microsoft when providing the URL to Microsoft.