GoDaddy Microsoft 365 Defederation: The Questions Small Firms Ask Before They Start (Whole Tenant, GoDaddy's Role, Downtime, Licenses, What Comes After)
Microsoft 365 bought through GoDaddy sits in your own tenant, but the sign-in path, the admin rights and the billing run through GoDaddy. Defederation takes those three things back without moving a single mailbox. The questions below are the ones small firms ask us before they say go: is it really the whole tenant, what does GoDaddy have to do, does email stop, what happens to the licenses already paid for, and what does the tenant need once it is ours.
What defederation changes, and why it is always the whole tenant
Defederation does three things and nothing else. It converts the tenant's domains from GoDaddy's federated sign-on to Microsoft Entra managed sign-in, it removes GoDaddy's delegated administration so your own account holds Global Administrator, and it moves licensing and billing to a direct Microsoft relationship through a Cloud Solution Provider. Nothing migrates: same tenant, same mailboxes, history, folders, calendars, contacts, aliases, shared mailboxes, OneDrive, SharePoint and Teams. The tenant was always yours; what changes hands is the front door, the keys and the invoice.
It is a tenant-level operation, not a per-domain one. Every domain verified on the tenant, including a secondary domain nobody uses any more or one left over from an old trading name, converts in the same run. Miss one and the users whose sign-in name is on it are locked out while everyone else works. That is why GoDaddy Microsoft 365 Defederation and Tenant Takeover is priced per tenant, $525 per project over two days, rather than per mailbox: the work is in the inventory and the sequencing, not the head count.
If the goal is to consolidate into a tenant you already run, defederation is the wrong tool; the sibling GoDaddy to Microsoft 365 tenant-to-tenant migration moves the mailboxes instead, and we help you choose in the first call.
GoDaddy's part: the one ticket only you can open
GoDaddy accepts a release request only through its own support channel and only from the holder of the GoDaddy account. Nobody else can open that ticket: not us, not Microsoft. What we do is prepare the wording of the request so it asks for the right thing the first time, stay on the line with you if you want that, and take over the moment GoDaddy responds.
When GoDaddy processes the release it resets the tenant's admin password and issues a temporary one, typically within one business day. From that point the tenant is in our hands for the conversion and takeover, and GoDaddy's delegated administrative access is removed as part of it.
Two things stay put. The domain registration, website and hosting can remain at GoDaddy indefinitely; registration and Microsoft 365 federation are separate things, and the service leaves the non-Microsoft products in the GoDaddy account alone. And the tenant's .onmicrosoft.com name stays as GoDaddy assigned it; Microsoft provides no way to rename it, for any customer.
Downtime, the password change and what users see
Mail flow does not stop. MX records do not change, mailboxes do not move, and messages keep arriving throughout. What users experience is a sign-in event: one password change, then a prompt to sign in again in Outlook, the Office apps and on their phones.
Our service page describes users keeping the credentials and MFA registrations they already have, and MFA registrations do carry through. The planning assumption to give your staff, from the engagements we have run, is one password change per person. We run the conversion outside business hours, hand the new credentials to you in advance, and supply a short instruction sheet that takes about two minutes per person. Tell people the evening before, and the next morning is uneventful.
One symptom clears on its own. GoDaddy-managed tenants are locked down, so features that need settings GoDaddy does not expose throw access errors, Copilot being the common example lately. They are typical of the arrangement, not of your licenses, and go away once the restrictions are lifted.
Licenses and billing: what moves, what waits and the tail
Licenses bought through GoDaddy most likely stay in the tenant until they expire: monthly subscriptions at month end, annual ones at term end. Replacement licensing through the CSP is staged and assigned as the last step, once the tenant is verified self-sufficient, so nobody has a coverage gap. In the rare case that GoDaddy licenses do not carry over, replacements are procured through the CSP and assigned in the same window.
GoDaddy cannot fully remove its reseller relationship until every GoDaddy subscription has expired. That is a billing tail, not a functional block: the tenant is yours, the sign-in is Microsoft's, and the last GoDaddy line runs out on its renewal date.
After the switch, upgrades to a higher plan can be placed at any time; downgrades and cancellations wait for renewal dates. You gain the full Microsoft catalog plus the CSP partner catalog at Microsoft's list price, instead of the GoDaddy plan menu. Why buy Microsoft licensing from a CSP instead of direct covers the relationship, and Switching Microsoft CSP partners explains why a billing transfer never touches data; defederation is the same principle with the sign-in path added.
What comes after, and how the engagement runs
A defederated tenant is a standard Microsoft 365 tenant that has never been administered by you. The first month is about making it yours:
- A licensing review. GoDaddy plans do not map one-to-one to Microsoft's; most small firms land on Microsoft 365 Business Premium, which includes Entra ID P1 and Conditional Access. The Tenant Optimizer scan (read-only, at no charge, Global Administrator required) lists every license and who holds it.
- MFA and Conditional Access set up properly: Enable MFA for All Users ($700 per project) and Conditional Access Policy Implementation ($2,950 per project) are the fixed-price pieces; the defederation itself restores your pre-cutover posture and includes no new security design.
- Reauthentication support for the stragglers: the phone that was off, the laptop in a drawer.
- DNS and email security reviewed: SPF, DKIM and DMARC in the order our setup guide describes, with Additional Spam and Phishing Protection ($800 per project) if the records were never done.
- Validation: mail in both directions, shared mailbox and alias access, calendars, and sign-in on every device.
The engagement runs in one sequence: your green light; a 20 to 30 minute kickoff call to review users, shared mailboxes, aliases, GoDaddy plans and every domain; the defederation; validation and user support; your confirmation; then the invoice, with no payment up front. For a firm with client files to protect, the follow-on is usually SharePoint structure; how law firms should structure SharePoint for compliance is the version we hand to professional-services clients.
Frequently asked questions
Do we have to move our domain away from GoDaddy?
No. Registration and Microsoft 365 federation are separate things; the domain, website and hosting stay at GoDaddy for as long as you like.
Is it one domain or all of them?
All of them. Every domain verified on the tenant, including secondary and retired ones, converts in the same run, which is why the kickoff call inventories domains, not only users.
Will email stop during the cutover?
No. Mail flow is untouched because nothing about MX records or mailboxes changes. Users see one password change and a prompt to sign in again, which is why the run is scheduled outside business hours with credentials handed over in advance.
What happens to the licenses we bought from GoDaddy?
They most likely keep running until their expiration, monthly at month end and annual at term end, and CSP licensing takes over from there. GoDaddy's reseller relationship ends when the last of them expires; in the rare case a license does not carry over, a replacement is procured and assigned.
Can we change plans afterwards?
Upgrades can be placed at any time; downgrades and cancellations wait for the renewal date of the subscription concerned. The full Microsoft catalog plus the CSP partner catalog is open to you from the first day.
Sources
- IT Partner service pages (content/services/): GoDaddy Microsoft 365 Defederation & Tenant Takeover (ITPWW176MIGOT): scope, sequencing, prerequisites, exclusions, price; GoDaddy to Microsoft 365 Tenant-to-Tenant Cutover Email Migration (ITPWW175MIGOT); Enable MFA for All Users; Conditional Access Policy Implementation; Additional Spam and Phishing Protection
- IT Partner subscription page: Microsoft 365 Business Premium (content/subscriptions/CFQ7TTC0LCHC__Commercial.json)
- IT Partner blog posts (content/blog/new/): SPF, DKIM and DMARC for Microsoft 365; Why Buy Microsoft Licensing From a CSP Instead of Direct; Switching Microsoft CSP Partners; How Law Firms Should Structure SharePoint for Compliance
- IT Partner tool page: Tenant Optimizer (src/app/tools/tenant-optimizer/page.tsx)
- IT Partner engineering notes, September 2026
| The question | The short answer | What it depends on |
|---|---|---|
| Whole tenant or one domain? | The whole tenant; every verified domain converts in one run | The domain inventory at kickoff |
| Does anything migrate? | No; same tenant, mailboxes, files and Teams | Only sign-in, administration and billing change |
| Who talks to GoDaddy? | The GoDaddy account holder opens the release ticket; we write it and take over on the response | GoDaddy's response, typically within one business day |
| Will email stop? | No; MX records and mailboxes are untouched | Nothing on your side |
| What do users do? | One password change and a re-sign-in, about two minutes each | Credentials handed over in advance; run outside business hours |
| What happens to GoDaddy licenses? | They most likely run to expiration; CSP licensing takes over | Monthly at month end, annual at term end |
| When does GoDaddy leave the billing? | When the last GoDaddy subscription expires | A billing tail, not a functional block |
| Cost, and when do we pay? | $525 per tenant, two days, invoiced after you confirm | No payment up front |
Key takeaways
- Defederation converts every domain on the tenant to Microsoft Entra managed sign-in, removes GoDaddy's delegated administration and moves billing to a CSP; nothing migrates.
- Only the GoDaddy account holder can open the release ticket; we write it, wait with you and take over when GoDaddy resets the admin password, typically within one business day.
- Mail flow never stops; plan for one password change and a re-sign-in per user, run outside business hours with a two-minute instruction sheet.
- GoDaddy-bought licenses most likely run to their expiration and CSP licensing takes over; GoDaddy's reseller relationship ends when the last of them expires, a billing tail rather than a block.
- The tenant then needs what GoDaddy never let you do: a licensing review, MFA and Conditional Access, SPF, DKIM and DMARC, and a validation pass on every device.
If you are on GoDaddy's Microsoft 365 and want the tenant back, the GoDaddy Microsoft 365 Defederation and Tenant Takeover service is $525 per tenant over two days, with no payment up front: kickoff call, conversion outside business hours, validation, your confirmation, then the invoice. If the plan is to fold the GoDaddy tenant into one you already run, start with the GoDaddy to Microsoft 365 tenant-to-tenant migration instead; we confirm which fits on the first call.
Questions this article didn’t answer?
Thirty minutes with Mike — our CEO, not a sales rep. Bring the hard version of the question.