FG-134
14 min read
Last checked November 7, 2026

How to Move Microsoft 365 Away From GoDaddy Without Losing Mail

Microsoft 365 from GoDaddy signs you in through GoDaddy and locks down the admin center. Learn how to confirm federation, weigh your options and move away in an order that keeps mail flowing.

Run the health check

You have Microsoft 365 email, but you bought it through GoDaddy. When you sign in to Outlook on the web, you end up on a GoDaddy page instead of Microsoft’s. When you try to open the Microsoft 365 admin center, you are sent back to GoDaddy’s dashboard, or most settings are missing. You want to move to Microsoft directly, or to another provider, add your designer as an admin, turn on a feature GoDaddy does not offer, or your GoDaddy billing has lapsed and you are worried about losing the mailboxes.

All of these come from the same design: a GoDaddy Microsoft 365 tenant is usually federated, which means GoDaddy, not Microsoft, checks everyone’s password. Undoing that is called defederation. It is entirely possible, but it touches how every person signs in, and a mistake can lock the whole company out of email. This guide explains how to confirm what you have, the routes out and their trade-offs, and an order of operations that keeps mail flowing. Read it all before you change anything. If you are not comfortable with PowerShell and admin roles, this is a job worth paying an experienced Microsoft 365 administrator to do.

Policies and procedures at both GoDaddy and Microsoft change. Where a detail depends on their current policy, this guide says so, and you should check it with them before relying on it.

What is happening

Every Microsoft 365 customer has a tenant: a private directory of users, mailboxes, licenses and settings. Every tenant has a built-in domain ending onmicrosoft.com, plus any custom domains you add, such as example.com. For each custom domain, the tenant records an authentication type.

Authentication type	Who checks the password	What users see
Managed	Microsoft Entra ID (Microsoft’s own identity service)	Microsoft’s sign-in page throughout
Federated	An outside identity provider; for Microsoft 365 from GoDaddy, that is GoDaddy	They type their address at Microsoft, then get redirected to the identity provider’s page (for GoDaddy, a GoDaddy sign-in page such as `sso.godaddy.com`)

GoDaddy also sits in your tenant as the reseller partner, holds the licenses you pay GoDaddy for, and limits what the customer can do in the admin center. The practical effects:

Passwords and MFA for users on your domain live at GoDaddy, not at Microsoft.
You may not have a real Global Administrator account. Admin links lead back to GoDaddy’s own management pages.
Features that need full admin access (some security settings, adding outside admins, certain apps) are unavailable.
The licenses belong to the GoDaddy subscription. If it is canceled or lapses, the licenses go, and with them access to mailboxes, after whatever retention period applies. Ask GoDaddy, in writing, how long that is before you let anything lapse.

Other resellers sell Microsoft 365 in a similar way. The steps below are written for GoDaddy because it is by far the most common case, but the checks and the order of operations apply to any federated tenant.

Before you start

Do not cancel anything yet. Do not cancel the GoDaddy Microsoft 365 plan, delete mailboxes, remove the domain from the tenant, or change MX records. Each of those can stop mail or destroy data.
Do not buy Microsoft 365 elsewhere yet. Buying a new subscription with the same domain usually creates a brand-new, empty tenant. Your domain can only be verified in one tenant at a time, so you end up with two tenants and a much bigger migration. GoDaddy’s own move guidance warns against this.
Make sure the email address on your GoDaddy account is not one of the mailboxes you are moving. If the GoDaddy login uses the mailbox that might lose access, you can lock yourself out of the account you need to finish the job. Change it to an outside address first.
Know who uses what. List every user, shared mailbox, alias, distribution group, and every device or app that signs in (phones, Outlook, scanners, the website’s SMTP settings).
PowerShell commands below run on your own Windows, Mac or Linux computer in PowerShell 7 (or Windows PowerShell 5.1), never on a web server.

Step 1: Confirm the tenant is federated

Look at the sign-in page

Open a private browser window, go to outlook.office.com and type one of your addresses. If you are redirected to a GoDaddy-branded page to enter the password, the domain is federated to GoDaddy.

Ask Microsoft’s realm lookup

Microsoft’s sign-in service answers a public question about any address: is this domain managed or federated? Run this in Terminal (macOS, Linux) or PowerShell on Windows, replacing the address with a real one on your domain:

curl -s "https://login.microsoftonline.com/getuserrealm.srf?login=user@example.com&xml=1"

curl -s fetches the address silently; on Windows PowerShell use curl.exe so you get the real curl rather than the PowerShell alias. You can also paste the address into a browser. The answer is a short block of XML (use json=1 instead of xml=1 if you prefer JSON). Look at three fields:

<NameSpaceType>Federated</NameSpaceType> means sign-in is handed to an outside provider. Managed means Microsoft handles it.
<AuthURL> appears for federated domains and shows where sign-in is sent. A GoDaddy address here confirms who the provider is.
<FederationBrandName> shows the organization name the tenant displays.

Unknown means the domain is not in any Microsoft 365 tenant. This endpoint is not formally documented by Microsoft, so treat it as a quick check and confirm in the tenant itself once you have admin access.

Find the tenant’s onmicrosoft.com name

You need this name for admin sign-in and for support conversations. Places to find it:

In the admin center (if GoDaddy’s view lets you in), Settings, Domains lists every domain including TENANT.onmicrosoft.com.
GoDaddy tenants often have a name starting with NETORG; check the name shown for your organization in the Microsoft 365 admin center.
GoDaddy support can tell you.

If you already have admin access

Install-Module Microsoft.Graph -Scope CurrentUser
Connect-MgGraph -Scopes "Domain.Read.All"
Get-MgDomain | Format-Table Id, AuthenticationType, IsDefault, IsVerified

The first line installs the Microsoft Graph PowerShell module for your user only; skip it if you have it. The second signs in and asks for permission to read domains. The third lists every domain with its authentication type. Good evidence: example.com shows Federated and TENANT.onmicrosoft.com shows Managed. If you cannot sign in at all with a GoDaddy-redirected account, you do not yet have usable admin access; see Step 3.

Step 2: Choose your route

Route	How it works	Good for	Trade-offs
Stay with GoDaddy	Change nothing	Small offices that only need email and are happy with GoDaddy’s billing and support	No full admin access; features and admin options limited; everything depends on the GoDaddy account staying paid and accessible
GoDaddy’s assisted move	GoDaddy’s help article “Move my Microsoft 365 email away from GoDaddy” describes a support-led process: you contact GoDaddy, they open a request, remove federation, and give your admins temporary passwords to sign in at Microsoft directly. You then buy licenses from Microsoft or another provider.	Most owners; the same tenant and mailboxes stay in place, so no mail copy is needed	Depends on GoDaddy’s current process and timing, so ask them first; GoDaddy says add-ons are removed and the move cannot be undone; you must have new licenses in place before GoDaddy’s end
Do it yourself	Get a working Global Administrator, convert the domain from Federated to Managed with Microsoft Graph PowerShell, remove GoDaddy’s partner access, re-license	Experienced admins, or when GoDaddy’s process stalls	Easy to lock users out if done in the wrong order; needs a cloud-only admin account first; GoDaddy’s licenses must not lapse in the middle
Tenant-to-tenant migration	Create a new tenant directly with Microsoft (or a partner), copy mailboxes and files across with a migration tool, then move the domain	When you cannot get admin access to the GoDaddy tenant, or want a clean start	Most work; the domain must be removed from the old tenant before it can be verified in the new one, which forces a short cutover window for mail; migration tools usually cost money

For most small businesses, GoDaddy’s assisted move is the safest start. Ask GoDaddy for it in writing, and read their current help article before you call, because it lists what to prepare.

Step 3: Back up before anything changes

Whichever route you take, take a copy of everything first. Defederation itself does not delete mail, but a lapsed license or a wrong click can.

Mailboxes: in classic Outlook for Windows, File, Open & Export, Import/Export, “Export to a file”, then Outlook Data File (.pst), for each mailbox. Outlook on the web does not export PST files, and new Outlook may not either depending on your version, so use classic Outlook if you can. For more than a few users, a commercial backup or migration service that reads the mailbox directly is faster and more reliable.
OneDrive and SharePoint: sync or download important libraries.
Settings: screenshot users and licenses, aliases, distribution groups, shared mailboxes and their members, forwarding, and mail flow rules.
DNS: save your current records with dig example.com MX +short, dig example.com TXT +short, dig autodiscover.example.com +short and the two DKIM selector CNAMEs (selector1._domainkey and selector2._domainkey). The DNS lookup tool does the same in a browser.

Step 4: Get a real Global Administrator

You cannot run a defederation, or manage the tenant afterward, without a Global Administrator account that signs in at Microsoft rather than at GoDaddy. That means an account on the onmicrosoft.com domain, which is always Managed.

Under GoDaddy’s assisted move, GoDaddy provides temporary admin credentials as part of the process.
Some tenants already have an original admin account on the onmicrosoft.com domain created at setup. GoDaddy support can confirm, and reset its password.
Ask GoDaddy for “a Global Administrator account on our onmicrosoft.com domain, signing in directly at Microsoft, with MFA”. Ask for the request number in writing.

Once you have it, sign in at admin.microsoft.com in a private window using admin@TENANT.onmicrosoft.com, set up MFA on it immediately, and create a second cloud-only Global Administrator as a spare. Store both sets of credentials somewhere that does not depend on this email system.

Step 5: The order of operations

This sequence keeps mail flowing because it never touches the things that route mail (MX, autodiscover, mailboxes) and never leaves users unlicensed.

Back up (Step 3) and confirm admin access (Step 4).
Pick a quiet window, such as a Friday evening, and tell staff in advance that they will need to sign in again with a new password. Give them the new passwords through a channel other than email.
Arrange new licenses from Microsoft directly or a partner, purchased into this existing tenant (signed in as your new Global Administrator), not as a new signup. Do not let them overlap with a cancellation of GoDaddy’s licenses until users are assigned the new ones.
Remove federation: either GoDaddy does it under their process, or you do it yourself as below.
Reset every user’s password in the admin center (Users, Active users, Reset password). Their GoDaddy password no longer applies once the domain is Managed.
Turn on Microsoft MFA (Security defaults or Conditional Access) and have users register their methods. MFA they had at GoDaddy does not carry over.
Assign the new licenses to each user, then remove the GoDaddy licenses, then ask GoDaddy to end the subscription. Never the other way round.
Remove GoDaddy’s partner access in the admin center under Settings, Partner relationships, once you no longer need their help (you may need to select Show all to see Settings).
Leave MX and autodiscover alone. They already point at Exchange Online. Changing them is not part of defederation.
Verify (Step 7).

Step 6: The do-it-yourself conversion

Only do this if GoDaddy’s process is not available to you, you have a cloud-only Global Administrator, and new licenses are ready. The older MSOnline cmdlet Set-MsolDomainAuthentication that many old guides use is retired; use Microsoft Graph PowerShell.

Connect-MgGraph -Scopes "Domain.ReadWrite.All","Domain-InternalFederation.ReadWrite.All"
Get-MgDomain -DomainId example.com | Select-Object Id, AuthenticationType
Get-MgDomainFederationConfiguration -DomainId example.com | Format-List

Sign in as admin@TENANT.onmicrosoft.com when prompted, not as a user on example.com (that account signs in through GoDaddy and will stop working mid-change). Microsoft documents Domain.ReadWrite.All as the permission for updating a domain and lists Domain Name Administrator, Security Administrator and External Identity Provider Administrator as the least-privileged roles that can do it; a Global Administrator can too. The second line should show Federated. The third shows the federation settings, including the GoDaddy sign-in addresses and an Id you need next. Screenshot this output: it is your record of what was there.

Update-MgDomain -DomainId example.com -AuthenticationType "Managed"
Get-MgDomain -DomainId example.com | Select-Object Id, AuthenticationType

Update-MgDomain changes the domain’s authentication type; Microsoft’s reference defines the value as either Managed or Federated. Good: the second line now shows Managed. Microsoft’s federation migration guidance says the conversion can take up to 60 minutes to take full effect, so expect a period where sign-ins behave inconsistently. If Update-MgDomain refuses because a federation configuration still exists, remove it first, using the Id from the earlier output:

Remove-MgDomainFederationConfiguration -DomainId example.com -InternalDomainFederationId FEDERATION_ID

Replace FEDERATION_ID with the Id value. This deletes the GoDaddy federation settings for the domain. Microsoft’s documentation shows this cmdlet with exactly these two parameters. Run the getuserrealm check from Step 1 again: it should now show Managed, and signing in at outlook.office.com should stay on Microsoft’s page.

Then continue from item 5 in the order of operations: reset passwords, MFA, licenses.

Step 7: Verify mail, sign-in and authentication

Sign-in: each user signs in at outlook.office.com with the new password and registers MFA. Watch the Entra sign-in logs for failures.
Inbound mail: send from an outside account to several mailboxes, aliases and groups.
Outbound mail: send to an outside Gmail account and check Show original for SPF, DKIM and DMARC pass with your domain.
DKIM: GoDaddy tenants do not always have DKIM enabled for the custom domain. Check the Defender portal (Email & collaboration, Policies & rules, Threat policies, Email authentication settings, DKIM) and enable it as described in setting up Microsoft 365 email correctly.
Records: run the domain through the email diagnostic tool and compare with the DNS you saved in Step 3. Nothing about MX, SPF or autodiscover should have changed.

What breaks, and how to fix it

What	Why	Fix
Passwords stop working	The GoDaddy password no longer applies	Admin resets each password; users sign in again
MFA prompts change or disappear	GoDaddy’s MFA no longer applies	Enable Microsoft MFA and have users register
Outlook keeps asking for a password	Cached GoDaddy sign-in tokens	Sign out of Office apps, clear saved credentials, sign in again (see mail apps that keep asking for a password)
Phones stop syncing	Mail profiles hold the old sign-in	Remove and re-add the account as Microsoft Exchange
Website contact form stops sending	The SMTP password it used changed	Update the SMTP plugin; consider OAuth or a transactional service (see WordPress not sending email)
Scanners and line-of-business apps fail	Same as above	Update each with new credentials, or move them to a supported sending method

The tenant-to-tenant alternative

If you cannot get admin access to the GoDaddy tenant, or you want to start clean, you can move to a new tenant instead. The outline: create the new tenant directly with Microsoft using its own onmicrosoft.com name; create users there; copy mailboxes and files with a migration tool while the old tenant still runs; then, in a planned window, remove the domain from the old tenant (which GoDaddy or an old-tenant admin must do), verify it in the new tenant, update MX, autodiscover, SPF and DKIM, and run a final copy of anything that arrived in between. Mail sent during the window queues at senders and retries, but plan it carefully with a short TTL. Moving email without losing mail covers the copy and cutover order, and website and email at different providers covers the DNS layout.

When to get help

Hire an experienced Microsoft 365 administrator or a Microsoft partner if any of these apply: you have more than a handful of users, you cannot get a cloud-only Global Administrator, the tenant has shared mailboxes, Teams, SharePoint sites or devices joined to it, there is a deadline such as GoDaddy billing ending, or you are not comfortable running the PowerShell above. A lockout during a defederation can take days to unwind.

What to ask GoDaddy

“Please start the process to move our Microsoft 365 away from GoDaddy, including removing federation for example.com. What is the request number, and what will happen to our licenses and add-ons, and when?”
“Please confirm our tenant’s onmicrosoft.com name and provide a Global Administrator on that domain that signs in directly at Microsoft.”
“How long will our mailboxes stay licensed after the move, and what is your refund policy for the current term?”

What to ask Microsoft support

Open a case from the admin center as your cloud-only Global Administrator. Give the tenant name, the domain, the output of Get-MgDomain and Get-MgDomainFederationConfiguration, and what GoDaddy has told you.
Ask Microsoft to confirm the domain’s authentication type and whether any partner relationship or delegated admin access remains.

If staff are already locked out and mail is not arriving, the locked out Emergency Room page and email stopped working are the fast routes. If you suspect someone else changed the admin or sign-in settings, treat it as a compromise and read email account hacked as well.