How to Move Microsoft 365 Off GoDaddy: The Defederation Steps, In Order
Moving a GoDaddy-managed Microsoft 365 tenant to direct billing takes eight steps, and doing two of them out of order can delete every user account and release your primary domain. Here is the correct sequence, the current PowerShell, and what actually breaks for users.
The short answer: GoDaddy sells Microsoft 365 as a reseller and configures your domain as a federated identity provider pointing at its own sign-in endpoint. Leaving means converting that domain from federated to managed, then taking over licensing and billing directly. The conversion itself is one PowerShell command. The risk is not the command, it is the order: remove GoDaddy's delegated admin relationship before you cancel the GoDaddy subscription. Cancelling first can trigger deprovisioning that removes user accounts and releases your primary domain.
If your Microsoft 365 came from GoDaddy, you have probably already hit the wall: you cannot reach parts of the Microsoft 365 admin center, you cannot buy the licence you actually want, and security features you have paid for are not available to configure. This guide covers what GoDaddy's setup actually is, the eight steps to leave it in the correct order, the PowerShell that works today, and what genuinely changes for your users.
What "defederation" actually means
GoDaddy configures your domain in Microsoft Entra ID as a federated domain, pointing authentication at GoDaddy's own single sign-on endpoint rather than at Microsoft. That is why your users sign in through GoDaddy, why GoDaddy's portal manages your mailboxes, and why parts of the Microsoft admin experience are closed to you.
Defederation converts that domain to managed, so Microsoft Entra ID authenticates your users directly. Everything else — the licence purchase, the billing change, removing GoDaddy's admin access — is separate work that has to happen around it in a specific sequence.
Defederation is tenant-wide. It affects every domain in the tenant, not just the one you are thinking about. Inventory them before you start.
Before you start
- A real Global Administrator you control. Sign in to the Azure portal, open Microsoft Entra ID → Users, and find the
admin@<something>.onmicrosoft.comaccount GoDaddy created. Reset its password and sign in with it in a private browser window to confirm it works before you touch anything else. - DNS access at your registrar, so you can update records if they need to change.
- A way to pay Microsoft directly — a card on a direct subscription, or a CSP partner relationship ready to accept.
- A full user export, so you can reconcile afterwards and drive the password reset.
- A date and time communicated to users. Their passwords will change and they will have to sign in again everywhere.
The eight steps, in order
The order is the dangerous part
Steps 7 and 8 are the ones that ruin weekends. Removing GoDaddy's delegated admin relationship must happen before you cancel the GoDaddy subscription. Cancelling while GoDaddy still holds delegated administration can trigger deprovisioning that deletes user accounts and releases your primary domain from the tenant. There is no undo button on that.
1. Prepare users
Tell people the date, the time, and that they will need to sign in again on every device — laptop, phone, Outlook, Teams. Give them the instructions before the day, not during it.
2. Take real tenant admin
Reset the admin@<something>.onmicrosoft.com account and confirm you can sign in independently of GoDaddy. Do not proceed until this works.
3. Convert the domain to managed
This is the defederation itself. Use the Microsoft Graph PowerShell SDK:
Install-Module Microsoft.Graph.Identity.DirectoryManagement -Scope CurrentUser
Connect-MgGraph -Scopes "Directory.Read.All","Domain.Read.All","Domain.ReadWrite.All"
# Confirm which domains are federated before changing anything
Get-MgDomain | Select-Object Id, AuthenticationType, IsDefault
Update-MgDomain -DomainId "yourdomain.com" -AuthenticationType ManagedRe-run Get-MgDomain afterwards and confirm every domain reports Managed.
4. Reset every user password
Once the domain is managed, no user has a working password: their credentials lived with GoDaddy's identity provider, not in Entra ID. Set new temporary passwords for everyone and distribute them through a channel that is not the email account they have just lost access to.
5. Establish direct billing or a CSP relationship
Buy the subscriptions directly in the Microsoft 365 admin center, or accept the delegated relationship invitation from your new CSP partner. Do this now — before anything is cancelled.
6. Assign the new licences
Assign the new licences to users and remove the GoDaddy ones. Check the plan mapping rather than assuming: GoDaddy's packaging does not always line up one-to-one with Microsoft's SKUs, and a mailbox can lose features silently if you land on a smaller plan.
7. Remove GoDaddy's delegated admin access
In the Microsoft 365 admin center: Settings → Partner relationships → GoDaddy, and remove all roles. This is the step most guides omit, and it is the one that causes data loss when it is skipped. Confirm the relationship is gone before continuing.
8. Cancel the GoDaddy subscription
Only now, in GoDaddy's billing portal, cancel the Microsoft 365 subscription. Cancel the productivity subscription — not the domain registration, which is a separate product and easy to hit by accident.
What breaks, and what does not
- Passwords break. Every user needs a new one. This is unavoidable and is the single biggest source of support calls on the day.
- Sign-in sessions break. Outlook, Teams and mobile mail all prompt for re-authentication.
- Mail flow does not break, provided the mailboxes stay in the same tenant. Nothing is migrating; the tenant is changing hands, not moving.
- Your data does not move. Mailboxes, files and Teams stay exactly where they are.
- GoDaddy's email management portal stops working the moment the domain is managed. That is the point, but tell whoever used it.
Two things older guides get wrong
The PowerShell module. Most guides still reference the MSOnline module and cmdlets like Set-MsolDomainAuthentication. Microsoft retired MSOnline across all tenants during April and May 2025. Those commands do not run any more. Use the Microsoft Graph PowerShell SDK, as above.
The cancellation order. Guides that tell you to cancel the GoDaddy subscription as part of the cutover, before removing the partner relationship, are describing a sequence that can cost you your user accounts and your primary domain.
After the cutover
- Check your DNS records — MX, Autodiscover, SPF and DKIM — and confirm they point where Microsoft expects. You do not need to move nameservers or change registrar to complete a defederation; that is a separate decision, and doing it on the same weekend adds risk for no benefit.
- Turn on security. A GoDaddy-managed tenant usually has none of it configured. Security defaults are the ten-minute version; Conditional Access is the real answer once you have licensing for it.
- Reconcile against your user export and confirm every mailbox is licensed and signing in.
Common questions
Will we lose email or data when we defederate from GoDaddy?
No, provided the steps run in the correct order. Defederation changes how users authenticate, not where mailboxes live. Nothing migrates. Data loss happens when the GoDaddy subscription is cancelled while GoDaddy still holds delegated administration, which can trigger deprovisioning of user accounts and release the primary domain.
Do all users have to reset their passwords?
Yes. Under GoDaddy's federated setup the credentials are held by GoDaddy's identity provider, so no usable password exists in Microsoft Entra ID once the domain becomes managed. Every user needs a new password and must sign in again on every device.
Can I still use Set-MsolDomainAuthentication?
No. Microsoft retired the MSOnline PowerShell module across all tenants and clouds during April and May 2025. The current command is Update-MgDomain -DomainId "yourdomain.com" -AuthenticationType Managed, from the Microsoft.Graph.Identity.DirectoryManagement module.
How long does a GoDaddy defederation take?
The technical conversion takes minutes. The work around it — taking admin control, buying licences, resetting every password, and getting users signed back in — is what fills the window. A standard single-domain exit runs 5 to 10 business days from working access, with one scheduled evening or weekend cutover and password support running into the next business day.
If you would rather not run it yourself
The whole move is available as a fixed package: $3,500 fixed for a standard single-domain exit, covering the defederation, the licence transition, the password wave and the reconciliation afterwards. Or talk through the problem and get a reply within one business day, carrying a fixed price where the scope is already clear.
About this article
Published by AZ Innovations, which completes fixed-scope Microsoft 365, security, migration, and automation work. See who does the work or the delivered work.
Leave GoDaddy and take direct control of Microsoft 365.
The tenant is defederated from GoDaddy, direct Microsoft billing is established, mail flow is validated, and exceptions are reconciled.