# GoDaddy Microsoft 365 Defederation: The Questions Small Firms Ask Before They Start (Whole Tenant, GoDaddy's Role, Downtime, Licenses, What Comes After)

> What GoDaddy Microsoft 365 defederation changes, why every domain converts, what GoDaddy's part is, why every user gets a new password, licenses and what comes after.

Canonical: https://o365hq.com/blog/godaddy-microsoft-365-defederation-the-questions-small-firms-ask-before-they-start
Provider: IT Partner LLC — US Microsoft partner since 2006. Book: https://o365hq.com/book

Published: 2026-09-20 · Updated: 2026-11-03 · IT Partner

Microsoft 365 bought through GoDaddy sits in your own tenant, but the sign-in path, the admin rights and the billing run through GoDaddy. Defederation takes those three things back without moving a single mailbox. The questions below are the ones small firms ask us before they say go: is it really the whole tenant, what does GoDaddy have to do, does email stop, what happens to the licenses already paid for, and what does the tenant need once it is ours. Reviewed in October 2026 by the engineer who runs these projects: GoDaddy's support is not needed to remove the federation and comes in only afterwards, to cancel the licenses; every user's password is reset by us; MFA is Microsoft MFA; MX records can change; and the work runs during business hours.

## What defederation changes, and why it is always the whole tenant

Defederation does three things and nothing else. It converts the tenant's domains from GoDaddy's federated sign-on to Microsoft Entra managed sign-in, it removes GoDaddy's delegated administration so your own account holds Global Administrator, and it moves licensing and billing to a direct Microsoft relationship through a Cloud Solution Provider. Nothing migrates: same tenant, same mailboxes, history, folders, calendars, contacts, aliases, shared mailboxes, OneDrive, SharePoint and Teams. The tenant was always yours; what changes hands is the front door, the keys and the invoice.

It is a tenant-level operation, not a per-domain one. Every domain verified on the tenant, including a secondary domain nobody uses any more or one left over from an old trading name, converts in the same run. Miss one and the users whose sign-in name is on it are locked out while everyone else works. That is why [GoDaddy Microsoft 365 Defederation and Tenant Takeover](/services/godaddy-microsoft-365-defederation) is priced per tenant, $525 per project, rather than per mailbox: the work is in the inventory and the sequencing, not the head count. The elapsed time depends on the tenant and on the licensing switch, which usually takes longer than the conversion itself.

If the goal is to consolidate into a tenant you already run, defederation is the wrong tool; the sibling [GoDaddy to Microsoft 365 tenant-to-tenant migration](/services/godaddy-office-365-to-microsoft-365-email-migration) moves the mailboxes instead, and we help you choose in the first call.

## GoDaddy's part: the license cancellation, not the federation

GoDaddy's support is not needed to remove the federation. We work directly with you to reach an admin account in the tenant, starting from the GoDaddy-provided admin credentials or an admin account you already hold, and the technical work happens inside Microsoft Entra: the domain conversion, the password reset, the takeover of Global Administrator and the removal of GoDaddy's delegated administration from the tenant's partner relationships. GoDaddy comes in afterwards. Once the federation is removed and the replacement licensing is in place, we work with GoDaddy to cancel the Microsoft 365 licenses, which is why the first step of the engagement is asking you for delegated admin access to your GoDaddy account.

Two things stay put. The domain registration, website and hosting can remain at GoDaddy indefinitely; registration and Microsoft 365 federation are separate things, and the service leaves the non-Microsoft products in the GoDaddy account alone. And the tenant's .onmicrosoft.com name stays as GoDaddy assigned it; Microsoft provides no way to rename it, for any customer.

## Downtime, the new password and what users see

Mail flow does not stop. Mailboxes do not move and messages keep arriving throughout. MX records do not change unless your GoDaddy plan included GoDaddy's email security add-on, which sits in front of the mailboxes: then the records point at that filtering service and the plan switches them to Microsoft's. Either way, nobody loses mail.

Every user gets a new password, and we are the ones who set it. In a GoDaddy tenant the domain is federated: the user's password lives in GoDaddy's identity service, and Entra accepts GoDaddy's token without ever holding the password itself. When the domain becomes managed, every account needs a password that exists in Entra, and nothing creates one automatically; we reset each account ourselves. There is no technical way to carry the old password across; a firm that wants the "new" password to equal the old one would have to collect passwords from staff beforehand, which we do not do.

What we do instead is make the reset a plan rather than a surprise: the new passwords are prepared with you in advance and reset in bulk the moment the domains convert, with a change at first sign-in enforced. You hand the passwords to your users and announce the switch; user communication is yours, not part of the engagement. Each person then signs in again in Outlook, the Office apps and on their phones, which takes about two minutes. That re-sign-in is each user's own task; we step in when something breaks.

MFA after the cutover is Microsoft MFA; there is no separate GoDaddy MFA to carry over or lose. As part of the takeover we check that security defaults, the tenant setting that enforces MFA, are enabled, and we turn them on if they were off, so the tenant has MFA from day one. Depending on whether MFA was enabled before the defederation, users may be asked to register their MFA methods at the next sign-in; a tenant that already had it keeps its registrations.

The conversion runs during business hours. An after-hours window is available as a priced option, billed at the hourly rate with a three-hour minimum ($175 per hour) and quoted in advance.

One symptom clears on its own. GoDaddy-managed tenants are locked down, so features that need settings GoDaddy does not expose throw access errors, Copilot being the common example lately. They are typical of the arrangement, not of your licenses, and go away once the restrictions are lifted.

## Licenses and billing: what moves, what waits and the tail

Licenses bought through GoDaddy most likely stay in the tenant until they expire: monthly subscriptions at month end, annual ones at term end. Replacement licensing through the CSP is staged and assigned as the last step, once the tenant is verified self-sufficient, so nobody has a coverage gap. In the rare case that GoDaddy licenses do not carry over, replacements are procured through the CSP and assigned in the same window. This step usually takes longer than the conversion itself, which is why the engagement is not promised in a fixed number of days.

GoDaddy cannot fully remove its reseller relationship until every GoDaddy subscription has expired. That is a billing tail, not a functional block: the tenant is yours, the sign-in is Microsoft's, and the last GoDaddy line runs out on its renewal date.

After the switch, upgrades to a higher plan can be placed at any time; downgrades and cancellations wait for renewal dates. You gain the full Microsoft catalog plus the CSP partner catalog at Microsoft's list price, instead of the GoDaddy plan menu. [Why buy Microsoft licensing from a CSP instead of direct](/blog/why-buy-microsoft-licensing-from-a-csp-instead-of-direct) covers the relationship, and [Switching Microsoft CSP partners](/blog/switching-microsoft-csp-partners-how-a-subscription-transfer-works) explains why a billing transfer never touches data; defederation is the same principle with the sign-in path added.

## What comes after, and how the engagement runs

A defederated tenant is a standard Microsoft 365 tenant that has never been administered by you. The first month is about making it yours:

- A licensing review. GoDaddy plans do not map one-to-one to Microsoft's; most small firms land on [Microsoft 365 Business Premium](/subscriptions/microsoft-365-business-premium), which includes Entra ID P1 and Conditional Access. The [Tenant Optimizer](/tools/tenant-optimizer) scan (read-only, at no charge, Global Administrator required) lists every license and who holds it.
- MFA and Conditional Access set up properly: the defederation confirms security defaults are on and nothing more; [Enable MFA for All Users](/services/microsoft-365-mfa-implementation) ($700 per project) and [Conditional Access Policy Implementation](/services/microsoft-entra-id-conditional-access-policy-implementation) ($2,950 per project) are the fixed-price pieces when you want MFA and access rules managed through Conditional Access instead.
- Re-sign-in on each device is each user's own task, including the phone that was off and the laptop in a drawer; we help when something breaks.
- DNS and email security reviewed: SPF, DKIM and DMARC in the order [our setup guide](/blog/spf-dkim-dmarc-microsoft-365-setup-order-defender-for-office-365-plan-1-vs-plan-2) describes, with [Additional Spam and Phishing Protection](/services/exchange-online-spam-phishing-protection) ($800 per project) if the records were never done.
- Validation: mail flow, and only mail flow, because nothing was migrated. Sign-in on each device is checked by the users themselves.

The engagement runs in one sequence: your green light; delegated admin access to your GoDaddy account, which we ask for first; a 20 to 30 minute kickoff call to review users, MX records, security defaults, GoDaddy plans and every domain; the password plan; the defederation during business hours; the mail-flow check; your confirmation; then the invoice, with no payment up front. The GoDaddy licenses are cancelled with GoDaddy once the replacement licensing is in place. For a firm with client files to protect, the follow-on is usually SharePoint structure; [how law firms should structure SharePoint for compliance](/blog/sharepoint-compliance-structure-law-firms) is the version we hand to professional-services clients.

## Frequently asked questions

### Do we have to move our domain away from GoDaddy?

No. Registration and Microsoft 365 federation are separate things; the domain, website and hosting stay at GoDaddy for as long as you like.

### Is it one domain or all of them?

All of them. Every domain verified on the tenant, including secondary and retired ones, converts in the same run, which is why the kickoff call inventories domains, not only users.

### Do we need to open a ticket with GoDaddy?

Not to remove the federation. We work with you to reach an admin account in the tenant and do the conversion, the password reset and the takeover inside Microsoft Entra. GoDaddy comes in afterwards: with the delegated admin access to your GoDaddy account that we ask for as the first step, we work with GoDaddy to cancel the Microsoft 365 licenses once the tenant is verified self-sufficient.

### Will email stop during the cutover?

No. Mailboxes do not move and mail keeps arriving. MX records change only if your GoDaddy plan included GoDaddy's email security add-on, and that change is part of the plan; mail flow is verified after the cutover. What users see is a new password and a sign-in on each device.

### Do users keep their passwords?

No. The password of a federated user lives in GoDaddy's identity service, and nothing creates a new one automatically when the domain becomes managed: we reset every account ourselves. We prepare the new passwords with you in advance and set them the moment the domains convert. MFA is Microsoft MFA with security defaults on; users who had no MFA before may be asked to register their methods at the next sign-in.

### What happens to the licenses we bought from GoDaddy?

They most likely keep running until their expiration, monthly at month end and annual at term end, and CSP licensing takes over from there. GoDaddy's reseller relationship ends when the last of them expires; in the rare case a license does not carry over, a replacement is procured and assigned.

### Can we change plans afterwards?

Upgrades can be placed at any time; downgrades and cancellations wait for the renewal date of the subscription concerned. The full Microsoft catalog plus the CSP partner catalog is open to you from the first day.

## Sources

- Microsoft Learn, "Convert-MsolDomainToStandard" and "Update-MgDomain": the cmdlets that convert a federated domain to managed authentication; read October 15, 2026.
- Microsoft Q&A, "Defederate account from GoDaddy", April 2026: Microsoft support confirms passwords must be reset for all users after defederation.
- Microsoft Learn, "Security defaults in Microsoft Entra ID": the tenant setting that requires every user to register for and use multifactor authentication; read October 16, 2026.
- IT Partner service pages: GoDaddy Microsoft 365 Defederation & Tenant Takeover (/services/godaddy-microsoft-365-defederation): scope, sequencing, prerequisites, exclusions, price; GoDaddy to Microsoft 365 Tenant-to-Tenant Cutover Email Migration (/services/godaddy-office-365-to-microsoft-365-email-migration); Enable MFA for All Users (/services/microsoft-365-mfa-implementation); Conditional Access Policy Implementation (/services/microsoft-entra-id-conditional-access-policy-implementation); Additional Spam and Phishing Protection (/services/exchange-online-spam-phishing-protection)
- IT Partner subscription page: Microsoft 365 Business Premium (/subscriptions/microsoft-365-business-premium)
- IT Partner blog posts: SPF, DKIM and DMARC for Microsoft 365 (/blog/spf-dkim-dmarc-microsoft-365-setup-order-defender-for-office-365-plan-1-vs-plan-2); Why Buy Microsoft Licensing From a CSP Instead of Direct (/blog/why-buy-microsoft-licensing-from-a-csp-instead-of-direct); Switching Microsoft CSP Partners (/blog/switching-microsoft-csp-partners-how-a-subscription-transfer-works); How Law Firms Should Structure SharePoint for Compliance (/blog/sharepoint-compliance-structure-law-firms)
- IT Partner tool page: Tenant Optimizer (/tools/tenant-optimizer)

| The question | The short answer | What it depends on |
|---|---|---|
| Whole tenant or one domain? | The whole tenant; every verified domain converts in one run | The domain inventory at kickoff |
| Does anything migrate? | No; same tenant, mailboxes, files and Teams | Only sign-in, administration and billing change |
| Who talks to GoDaddy? | We do, after the federation is removed, to cancel the licenses; removing the federation itself needs nothing from GoDaddy | Delegated admin access to your GoDaddy account, requested as the first step |
| Will email stop? | No; mailboxes are untouched, and MX records change only where GoDaddy's email security add-on is in use | Whether that add-on was part of your GoDaddy plan |
| What do users do? | A new password, reset by us, and a sign-in on each device, about two minutes each | Passwords prepared in advance; business hours by default, after-hours at the hourly rate |
| Does MFA carry over? | It is Microsoft MFA either way; security defaults are confirmed on, and users without MFA before register methods at the next sign-in | Whether MFA was enabled before the defederation |
| What happens to GoDaddy licenses? | They most likely run to expiration; CSP licensing takes over | Monthly at month end, annual at term end |
| When does GoDaddy leave the billing? | When the last GoDaddy subscription expires | A billing tail, not a functional block |
| Cost, and when do we pay? | $525 per tenant, invoiced after you confirm | No payment up front; elapsed time depends on the licensing switch |

## Key takeaways

- Defederation converts every domain on the tenant to Microsoft Entra managed sign-in, removes GoDaddy's delegated administration and moves billing to a CSP; nothing migrates.
- GoDaddy's support is not needed to remove the federation: we reach an admin account in the tenant with you and do the conversion, the password reset and the takeover inside Microsoft Entra; GoDaddy comes in afterwards, when we cancel the licenses with them.
- Every user gets a new password, reset by us, because nothing creates one automatically when a federated domain becomes managed; we prepare them in advance and set them the moment the domains convert. MFA is Microsoft MFA with security defaults on; users without MFA before register methods at the next sign-in.
- Mail never stops; MX records change only where GoDaddy's email security add-on was in front of the mailboxes. The work runs during business hours, with an after-hours window at the hourly rate.
- GoDaddy-bought licenses most likely run to their expiration and CSP licensing takes over; the licensing switch is the part that takes time, and GoDaddy's reseller relationship ends when the last subscription expires.

---

If you are on GoDaddy's Microsoft 365 and want the tenant back, the [GoDaddy Microsoft 365 Defederation and Tenant Takeover](/services/godaddy-microsoft-365-defederation) service is $525 per tenant with no payment up front: GoDaddy delegated access first, kickoff call, password plan, conversion during business hours, mail-flow check, your confirmation, then the invoice. If the plan is to fold the GoDaddy tenant into one you already run, start with the [GoDaddy to Microsoft 365 tenant-to-tenant migration](/services/godaddy-office-365-to-microsoft-365-email-migration) instead; we confirm which fits on the first call.