🛠️ PLS SOP: GoDaddy Domain Defederation

🎯 Purpose

To outline the steps required to remove domain federation (defederate) from a domain purchased or hosted via GoDaddy, typically to allow it to be added to a new Microsoft 365 tenant or hosted email provider.

📋 Scope

This procedure applies when transitioning a domain’s email service away from Microsoft 365 via GoDaddy and removing Microsoft SSO/federation settings.

✅ Pre-Requisites

  • Admin access to the GoDaddy account.

  • Admin access to the Microsoft 365 Admin Center (if previously linked).

  • Installed and configured Microsoft PowerShell with MSOnline or Microsoft Graph modules.

🔧 Procedure

1. Verify Domain Is Federated

  • Open PowerShell and run:

    powershell
    Connect-MsolService
    Get-MsolDomain -DomainName yourdomain.com

  • Look for Authentication method (should show Federated).

2. Convert Domain to Standard (Managed)

Run the following command to defederate the domain:

powershell
Set-MsolDomainAuthentication -DomainName yourdomain.com -Authentication Managed

Note: If your domain is linked via GoDaddy, you may need to manually change the DNS records later.

3. Remove Domain from Microsoft 365 Tenant (If Applicable)

  • Go to Microsoft 365 Admin Center > Settings > Domains

  • Select the domain and choose Remove (only works if all users, aliases, and services using the domain have been removed)

  • Delete all users and aliases associated with the domain first

4. Update DNS Records in GoDaddy

  • Log into your GoDaddy account

  • Navigate to Domains > Manage DNS

  • Remove Microsoft-specific records:

    • CNAME: autodiscover, sip, lyncdiscover

    • TXT: MS=xxx verification

    • MX: pointing to Microsoft (e.g., yourdomain-com.mail.protection.outlook.com)

  • Update or add DNS records as needed for the new email host or service

5. Verify DNS Propagation

Use tools like:

Confirm DNS records have cleared/updated across global servers.

6. Communicate Completion

Notify stakeholders:

  • The domain is no longer federated

  • The domain can now be added to a new tenant or service

  • Email delivery may take 24–48 hours to fully propagate

⚠️ Important Notes

  • Backup all DNS records before making changes.

  • Ensure no users or aliases are still using the domain before removal.

  • DNS propagation may temporarily impact services tied to the domain (email, Teams, etc.).

📩 Support

For assistance, contact: