Open a mailbox

Lures → + Build Lure. Set company, filename (pick a template or type your own), landing template, where Microsoft opens, and after-auth.

On the lure row click Deploy. aaPanel is the default tab. Enter a company name that is unique on your assigned domain — existing names on that domain are not overwritten. Copy the landing URL that comes back (portal-xxxx.your-assigned-domain/companyname/uuid/).

Shared aaPanel has a daily quota (default 5; admin can raise it). ZIP, AWS, and Cloudflare are unlimited alternatives.

Antibot → + New Antibot. On Routing, paste that aaPanel URL in Windows. Mac / iOS / Android fill in automatically. Other OS uses your decoy (default https://google.com).

On the gate row click Deploy. Choose a clean cPanel domain (aaPanel is lure-only). Copy the gate URL that comes back. ZIP download remains if you prefer to upload by hand. Do not put this gate on the Obsidian portal host.

After you change protection, routing, or country block, Deploy again (or re-upload the ZIP) or the live gate will not match the panel.

If it says live, you are done. Another click is a new Windows Hello sign-in and can get the device disabled.

Paste the script on login.microsoftonline.com (F12 Console → Enter) to sign in the box.

Do not click Health, PRT Live, or Cookie as a test. Those are extra Microsoft trips.

If Cookie later fails, or the bar says the device was rejected / Hello is gone: recapture. Do not keep clicking Resurrect.