Embed canary tokens in your login portal and route webhook trigger data into Microsoft Sentinel via Azure Logic Apps - detecting cloned or proxied login pages at the moment they load, before credentials are entered.