How to Defederate a GoDaddy Microsoft 365 Tenant

Background: The GoDaddy 365 Problem

Many small businesses initially signed up for Microsoft 365 through GoDaddy when purchasing their domain. It's a convenient bundle at the time — but it comes with a significant catch. GoDaddy federates the domain and tenant, which means the Microsoft 365 environment is tightly bound to GoDaddy's own identity infrastructure. The result? You can't transfer it to the CSP program or move it directly under Microsoft without going through a specific defederation process.

This is one of the more common headaches we encounter working with Virginia businesses that have outgrown their GoDaddy setup. The good news: you can fully defederate the tenant yourself using PowerShell — no need to sit on hold with GoDaddy support.

With this guide, you'll be able to:

• Defederate the tenant without performing a full migration
• Avoid calling GoDaddy entirely
• Preserve all existing user accounts
• Complete the process with zero mail flow downtime

High-Level Overview

1. Prepare your end users
2. Gain true tenant admin access within GoDaddy
3. Remove federation using PowerShell
4. Reset user passwords
5. Add a CSP provider or move direct to Microsoft
6. Provision licensing into the account
7. Remove GoDaddy as Delegated Admin and remove the Enterprise App
8. Cancel the GoDaddy subscription

Step A — Prepare Your End Users

Before touching anything in the tenant, take time to properly set expectations with your users. Defederation requires every user to reset their password — without a new password in hand, they won't be able to log in after the change is made.

• Either collect passwords from users in advance or prepare a temporary password list to distribute after defederation. A PowerShell script for bulk resets is included later in this guide.
• Pick a date and time — ideally outside of business hours — to perform the defederation. While mail flow won't be interrupted, users may notice disruptions in Office apps during the transition.
• Send users instructions on how to re-authenticate in their Office apps. For desktop apps: File → Account → Sign Out → Sign In. Outlook will prompt users to enter their new password the next time it connects.

Step B — Become a Tenant Admin in GoDaddy

Here's where things get a little unconventional. When a Microsoft 365 account is set up through GoDaddy, the initial admin account is redirected to GoDaddy's own portal when trying to access Microsoft's admin center. To run the defederation scripts, you need access to the true Global Admin — the hidden admin@<tenantname>.onmicrosoft.com account.

1. Login to Portal.Azure.com with the admin user that was set up when the account was first created and click on the 3 lines in the top left corner.
2. Click on Azure Active Directory. Then click on Users when the new tab opens.
3. Look for a user labeled admin@<tenantname>.onmicrosoft.com. Click on this user and reset their password. If you already have access to this user, you can skip this step.
4. Copy the temporary password and open an incognito/private browser window. Navigate to office.com and sign in with that username and the temporary password.
5. Set a new permanent password. You now have a fully functional Global Admin account capable of running the PowerShell commands in the next step.

Step C — Remove Federation with GoDaddy

⚠️ Before running this step: Make sure all users have been given the passwords they'll need after the change. Once the tenant is defederated, existing federated credentials will no longer work.

Run the following PowerShell cmdlets as Administrator to convert the domain from federated to managed:

Write-Host "Checking for MSGraph module..."

$Module = Get-Module -Name "Microsoft.Graph.Identity.DirectoryManagement" -ListAvailable

if ($Module -eq $null) {

        Write-Host "MSGraph module not found, installing MSGraph"
        Install-Module -name Microsoft.Graph.Identity.DirectoryManagement

    }
Connect-MgGraph -Scopes "Directory.Read.All","Domain.Read.All","Domain.ReadWrite.All","Directory.AccessAsUser.All"
#Enter the Admin credentials from "Become a tenant Admin in GoDaddy"

Get-MgDomain
#See that the domain is "federated"#

Update-MgDomain -DomainId "<InsertFederatedDomain>" -Authentication Managed

Replace <InsertFederatedDomain> with your actual domain (e.g. yourbusiness.com). After the command completes, run Get-MgDomain again to confirm the domain now shows as Managed.

📝 Important: ALL domains in the tenant must be in a managed state for this to work correctly — even domains that are no longer actively used.

Step D — Reset User Passwords

Now that the tenant is defederated, users need updated passwords. You have a few options depending on the size of the account.

Option 1 — Single User Update (PowerShell)

# --- Load Graph modules ---
Import-Module Microsoft.Graph.Users -ErrorAction Stop
Import-Module Microsoft.Graph.Authentication -ErrorAction Stop

# --- Connect to Graph ---
Write-Host "Connecting to Microsoft Graph..." -ForegroundColor Cyan
Connect-MgGraph -Scopes "User.ReadWrite.All"
$passwordProfile = @{
    Password                      = '<InsertPassword>'
    ForceChangePasswordNextSignIn = $true
}

Update-MgUser -UserId 'example@domain.com' -PasswordProfile $passwordProfile

Option 2 — Bulk Update from CSV

Create a CSV file in the following format:

UserPrincipalName,NewPassword
alice@contoso.com,P@ssw0rd123!
bob@contoso.com,Secur3Pwd!
charlie@contoso.com,Hada9200!

Then run this script, passing the path to your CSV file:

param(
[Parameter(Mandatory = $true)]
[string]$CsvPath
)

# --- Load Graph modules ---
Import-Module Microsoft.Graph.Users -ErrorAction Stop
Import-Module Microsoft.Graph.Authentication -ErrorAction Stop

# --- Connect to Graph ---
Write-Host "Connecting to Microsoft Graph..." -ForegroundColor Cyan
Connect-MgGraph -Scopes "User.ReadWrite.All"

# --- Import CSV ---
if (-not (Test-Path $CsvPath)) {
    throw "CSV file not found at path: $CsvPath"
}

$users = Import-Csv -Path $CsvPath
Write-Host "Processing $($users.Count) users from CSV..." -ForegroundColor Cyan
$results = @()

foreach ($user in $users) {
    $upn = $user.UserPrincipalName
    $newPassword = $user.NewPassword

    $passwordProfile = @{
        Password = $newPassword
        ForceChangePasswordNextSignIn = $true
    }

    try {
        Write-Host "Updating password for $upn ..." -ForegroundColor Yellow
        Update-MgUser -UserId $upn -PasswordProfile $passwordProfile
        $results += [pscustomobject]@{ UserPrincipalName = $upn; Status = "Success"; Error = $null }
    }
    catch {
        Write-Warning "Failed to update password for $upn : $($_.Exception.Message)"
        $results += [pscustomobject]@{ UserPrincipalName = $upn; Status = "Failed"; Error = $_.Exception.Message }
    }
}

Write-Host "Bulk password reset completed." -ForegroundColor Green
$results | Format-Table -AutoSize

Option 3 — Entra Admin Center (No PowerShell)

If you prefer a GUI approach, you can reset passwords one at a time in the Entra Admin Center under Users.

Steps E & F — Add Licensing Through Your CSP or Microsoft Direct

With the tenant now defederated and all users authenticated under their new credentials, you're ready to attach new licensing. If you're working with a Managed Service Provider like Yesteck, we'll add you to our CSP tenant and provision Microsoft 365 licenses on your behalf. Alternatively, you can link the tenant directly to a Microsoft billing account.

Either way — the hardest part is behind you. The tenant is now fully liberated from GoDaddy's federation, and licensing can be applied cleanly going forward.

Steps G & H — Remove GoDaddy Access and Cancel

Once new licensing is confirmed and all users are working normally, it's time to completely remove GoDaddy from the equation:

1. In the Microsoft 365 Admin Center, go to Settings → Partner relationships and remove GoDaddy as a Delegated Admin.
2. In Entra ID → Enterprise Applications, locate and delete the GoDaddy-related enterprise app.
3. Log into your GoDaddy account and cancel the Microsoft 365 subscription to stop ongoing billing.

A Note on Proofpoint

If the existing GoDaddy licensing included Proofpoint (an email security add-on bundled with some GoDaddy plans), be cautious during the licensing transition. Proofpoint routes mail through its own filtering infrastructure, and removing it without a replacement ready can affect mail flow. Have your email security solution in place before you cancel.

Need Help With Your Migration?

Defederating a GoDaddy tenant is one of those processes that looks straightforward on paper but has real potential for missteps — especially in multi-user environments or tenants with complex licensing. If you'd rather have an experienced team handle it, Yesteck is here.

We handle GoDaddy defederations and Microsoft 365 migrations regularly for Virginia businesses. Schedule a free consultation and we'll walk through exactly what's involved for your environment.