Expected: BDR flags Browser-in-the-Browser (spoofed address bar shows login.microsoftonline.com while the page is served elsewhere) → high severity, block page.