Tools / Microsoft 365 Tenant Checker

Free tool · No sign-up · Nothing you type is stored

Microsoft 365 Tenant Checker

Type a domain name and find out whether a Microsoft 365 tenant is registered for it, what its tenant ID is, which region holds it, whether it sits in the commercial or a government cloud, whether sign-in is managed or federated, and whether the domain’s mail runs on Exchange Online. Then read what a tenant is, how to find yours from the inside, and what to do with what you found.

01 Domain, email address or tenant ID

Reads Microsoft’s public sign-in discovery documents (the same ones the Microsoft 365 login page loads for every user) and the domain’s public DNS. Nothing you type is stored, logged or sent to analytics.

What a Microsoft 365 tenant is

A tenant is the dedicated instance of Microsoft Entra ID (the directory service formerly called Azure Active Directory) that Microsoft creates for an organization the first time it signs up for any Microsoft cloud service: Microsoft 365, Azure, Dynamics 365, Intune, Power BI, Power Platform. Everything the organization does in Microsoft’s cloud is attached to it: the user accounts and their passwords, the groups, the registered devices, the verified domains, the subscriptions and licenses, the security policies, the SharePoint sites, the Teams, the mailboxes.

A tenant is identified four ways, and the four are easy to confuse: a tenant ID (a GUID such as 4ed6ea8d-6f86-411d-b7e0-37401bdb9b68, permanent, used by administrators and applications), an initial domain ending in .onmicrosoft.com (chosen at sign-up, permanent, often called the tenant name), a display name (the organization name shown on the sign-in page, editable), and one or more custom domains such as contoso.com that the organization has verified in it, one of which is the default domain new users get.

Term	What it is	How many	Where to see it
Tenant	Your organization’s Entra ID directory and everything attached to it.	Usually one per organization; holding companies and roll-ups sometimes run several.	Entra admin center → Overview
Tenant ID	The GUID that identifies the tenant to Microsoft and to applications.	One per tenant, permanent.	Entra admin center → Overview → Properties; this checker
Initial domain	The `name.onmicrosoft.com` domain created at sign-up; the tenant name in everyday speech.	One per tenant, cannot be changed or removed.	Microsoft 365 admin center → Settings → Domains
Custom domain	A domain you own and verified in the tenant, used for sign-in names and email.	Many per tenant; each domain in one tenant only.	Settings → Domains; this checker
Subscription	A product bought into the tenant: Business Premium, E3, Azure, Dynamics 365.	Many per tenant, from one or more sellers.	Microsoft 365 admin center → Billing → Your products
Account	A user, guest or service identity inside the tenant.	Many per tenant; a person can be a guest in other tenants.	Entra admin center → Users

Three ways to check whether your domain has a tenant

1. Ask Microsoft from outside (this page)

When anyone types name@contoso.com on the Microsoft 365 sign-in page, the page asks two public documents where to send them: the user realm document, which says whether the domain is known and whether sign-in is managed or federated, and the tenant’s OpenID configuration document, which carries the tenant ID, the region scope and the cloud instance. The checker reads the same two documents and adds the domain’s public DNS.

2. Try to add the domain to a tenant you control

In the Microsoft 365 admin center open Settings → Domains → Add domain. A domain that is already verified in another tenant cannot be added, and the wizard says so. This is the test to run before a merger, a rebrand or a move away from a reseller, because it reveals the tenant that will have to release the domain first.

3. Look from the inside

Entra admin center → Overview shows the tenant ID and the primary domain. Microsoft 365 admin center → Settings → Domains lists every verified domain and marks the .onmicrosoft.com initial domain. In PowerShell, Get-MgOrganization and Get-MgDomain from the Microsoft Graph module return the same.

What “no tenant found” means

Microsoft’s sign-in service answers AADSTS90002: Tenant not found for the domain, so no tenant has it verified. Either the organization has never used a Microsoft cloud service under this domain, its tenant verifies a different domain, or the domain was removed. Someone can still sign up with an address at this domain, which is how unmanaged tenants appear.

What the region and the cloud tell you

The region scope in the tenant’s OpenID configuration is the geography Microsoft assigned to the tenant from the country chosen at sign-up. It governs where the directory’s data is partitioned, and the same country decides where Exchange Online, SharePoint and Teams keep the organization’s data (Microsoft publishes the mapping in its data-locations page, listed in the sources). The country cannot be edited after sign-up; Microsoft sells Multi-Geo and Advanced Data Residency add-ons for organizations that must keep specific workloads in another geography, and a tenant in the wrong country is otherwise replaced by a new one plus a migration.

Code	Region	What it means
`NA`	North America	The tenant's identity data is partitioned in Microsoft's North America region. Typical for organizations that chose the United States, Canada or Mexico at sign-up.
`EU`	Europe	The tenant's identity data is partitioned in Microsoft's European region. Typical for organizations that chose an EU or EFTA country, or the United Kingdom, at sign-up.
`AS`	Asia Pacific	The tenant's identity data is partitioned in Microsoft's Asia Pacific region.
`OC`	Oceania	The tenant's identity data is partitioned in Microsoft's Australia and New Zealand region.
`AF`	Africa	The tenant's identity data is partitioned in Microsoft's Africa region.
`SA`	South America	The tenant's identity data is partitioned in Microsoft's South America region.
`ME`	Middle East	The tenant's identity data is partitioned in Microsoft's Middle East region.
`WW`	Worldwide	No single geography is recorded for this tenant. Microsoft uses this scope for a small set of tenants, including its own.
`GCC`	GCC (Government Community Cloud)	US public-sector tenant on the commercial identity service with the GCC compliance boundary. Licensed from Microsoft's Government price list.
`DODCON`	GCC High	US Government tenant in the Azure Government identity service for organizations handling controlled unclassified information and ITAR data.
`DOD`	DoD	US Department of Defense tenant in the Azure Government identity service.

Microsoft does not publish the complete list of region codes. The codes above are the ones observed on live tenants on 2 November 2026; an unlisted code is shown as returned. GCC is a sub-scope on the worldwide identity service; DODCON (GCC High) and DOD tenants live on the separate login.microsoftonline.us service, which the checker follows automatically. Tenants operated by 21Vianet in China sit on login.partner.microsoftonline.cn.

Managed or federated sign-in

A managed domain means Entra ID checks the password itself. That covers cloud-only accounts and accounts synchronized from on-premises Active Directory with password hash sync or pass-through authentication. A federated domain means the sign-in page hands the user to another identity provider for the password: AD FS or another on-premises federation service, Okta, Ping Identity, OneLogin, Duo, or GoDaddy’s single sign-on for GoDaddy-resold Microsoft 365. The checker names the provider when the federation endpoint gives it away.

Federation is a design choice, not a defect, but it is also a dependency: when the federation server is down, nobody signs in. Organizations retiring AD FS move the domain to managed authentication; organizations leaving GoDaddy’s resale program defederate the domain, which returns the tenant to their own control with the mailboxes and data in place.

What the DNS signals mean

MX. Where the domain’s mail is delivered. contoso-com.mail.protection.outlook.com is Exchange Online. A security gateway (Proofpoint, Mimecast, Barracuda) in the MX record hides the final host; Google, GoDaddy, Zoho or Rackspace means the mailboxes are not in the tenant, whatever the tenant verifies.
SPF. The v=spf1 TXT record lists who may send as the domain. include:spf.protection.outlook.com authorizes Exchange Online. No SPF record at all is a deliverability problem regardless of the mail host.
Autodiscover. The autodiscover CNAME to autodiscover.outlook.com is how Outlook and phones find an Exchange Online mailbox from an email address.
DKIM selector1. A CNAME from selector1._domainkey to a name under the tenant’s .onmicrosoft.com domain means Exchange Online signs outbound mail. It is also the one public record that reveals the tenant’s initial domain, which is why the checker shows it as the tenant name.
enterpriseregistration and enterpriseenrollment. CNAMEs to enterpriseregistration.windows.net and enterpriseenrollment-s.manage.microsoft.com let devices find Entra ID and Intune from the user’s domain. Their absence does not stop Intune; their presence says someone set up device management deliberately.
DMARC. The _dmarc TXT record tells receivers what to do with mail that fails SPF and DKIM. p=none only reports; p=quarantine or p=reject protects the domain from being forged. No DMARC record is the usual finding on tenants that were never reviewed.
MS=ms… verification record. The TXT record Microsoft asks for when a domain is added. Harmless if it stays; its presence on a domain with no tenant means a verification was started and never finished, or a tenant that since released the domain.

Unmanaged tenants: when a tenant exists and nobody set it up

When someone with an address at your domain signs up for a free Microsoft service that uses Entra ID (Power BI, Teams, Power Automate), Microsoft creates an unmanaged tenant for the domain with that person inside it and no administrator. The checker will report the tenant as found. The organization that owns the domain can take it over: an internal takeover makes you its administrator, an external takeover moves the domain into the tenant you already run. Both start with the DNS TXT record that proves you own the domain, and both are routine work before a migration or a new tenant setup.

What to do with the result

Tenant found, mail on Exchange Online

The setup is complete; the question is whether it is configured well. The free health check reads the tenant with your consent, looks at licenses, Conditional Access, legacy authentication, mail protection and sharing, and reports in writing.

Free tenant health check

No tenant, or mail somewhere else

We create the tenant, verify the domain, build the baseline and move mailboxes from Google Workspace, GoDaddy, hosted Exchange or IMAP with a cutover you schedule, at a fixed price per migration.

Set up or migrate

Federated to GoDaddy

Defederation returns the tenant to you, keeps every mailbox and file, and moves the licenses to a CSP partner who answers the phone. One scheduled change, no data migration.

GoDaddy defederation

Prefer a conversation first? Book a 20-minute call with an engineer, or send the question with the report copied from the checker.

Tenant guides

Tenant services

Questions this page gets asked

What is a Microsoft 365 tenant, in one sentence?

A tenant is the dedicated instance of Microsoft Entra ID that Microsoft creates for your organization the first time it signs up for Microsoft 365, Azure, Dynamics 365, Intune or Power Platform; it holds your users, groups, devices, verified domains, subscriptions and settings, and every Microsoft cloud service you buy is attached to it.

Is a tenant the same as a subscription?

No. The tenant is the directory; subscriptions (Microsoft 365 Business Premium, E3, Azure pay-as-you-go) are bought into it and assigned to its users. One tenant usually carries several subscriptions from more than one seller, and a subscription cannot exist without a tenant.

Can one domain belong to two tenants?

No. A custom domain is verified in exactly one tenant at a time. To use it in another tenant it has to be removed from the first, which is the step every tenant-to-tenant migration schedules for its cutover window. Subdomains can be verified separately only if the parent domain is not verified elsewhere.

How do I find my tenant ID?

Type your domain into the checker above and copy the Tenant ID line, or sign in to the Microsoft Entra admin center and open Overview, where the tenant ID is shown under Properties. The same value appears in the issuer URL of the tenant's OpenID configuration document.

How do I find my tenant name (the onmicrosoft.com domain)?

In the Microsoft 365 admin center open Settings, then Domains: the initial domain ends in .onmicrosoft.com and is marked as such. From outside the tenant it is visible only when DKIM for Exchange Online is enabled, because the DKIM CNAME records point at that name; the checker reads them.

Can we change the region of our tenant?

The country chosen at sign-up fixes the tenant's home region and cannot be edited. Microsoft sells Multi-Geo and Advanced Data Residency add-ons that place specific workloads' data in other geographies, and the only way to move the whole tenant is to create a new one in the right country and migrate into it.

Why does my domain show as federated?

Sign-in for the domain is handed to another identity provider: AD FS or another on-premises federation service, Okta, Ping, or GoDaddy for GoDaddy-resold Microsoft 365. Managed means Entra ID checks the password itself, including when password hash sync is in place.

We use Microsoft 365 but the checker says no tenant was found. Why?

The tenant verifies a different domain than the one you typed (a parent company's domain, or the onmicrosoft.com initial domain only), or the domain was removed from the tenant. Try the domain in your sign-in address, or the onmicrosoft.com name, or the tenant ID.

Does the checker store the domains people look up?

No. The lookup reads Microsoft's public discovery documents and public DNS, returns the result to your browser and writes nothing; the only analytics it sends are enumerated outcomes such as found or not found and the region code, never the domain, the name or the id.

Sources

Add your custom domain — Initial onmicrosoft.com domain, custom domains, one tenant per domain. Microsoft Learn, updated 18 June 2026
How to find your Microsoft Entra tenant ID — Entra admin center, Azure portal and PowerShell paths. Microsoft Learn, updated 14 January 2025
Connect your domain by adding DNS records — The MX, SPF, Autodiscover, enterpriseregistration and enterpriseenrollment records this checker reads. Microsoft Learn, updated 23 April 2026
Microsoft 365 data locations — Which geography holds Exchange, SharePoint and Teams data for each sign-up country. Microsoft Learn, updated 1 April 2026
Take over an unmanaged directory as administrator — Internal and external admin takeover of a self-service (shadow) tenant. Microsoft Learn, updated 18 June 2026
Self-service sign up for email-verified users — How a Power BI or Teams sign-up creates an unmanaged tenant for a domain. Microsoft Learn, updated 13 December 2024
OpenID Connect on the Microsoft identity platform — The per-tenant discovery document the checker reads for the tenant id, region scope and cloud instance. Microsoft Learn, updated 30 June 2026
Live observation. Region scopes, sub-scopes and cloud instances as returned by Microsoft’s discovery endpoints for commercial, GCC and onmicrosoft.com tenants on 2 November 2026. The checker reads the endpoints live; nothing on this page is cached from a visitor’s lookup.