★ First page of Microsoft's 100,000-partner directory, sorted by responsiveness✓ Microsoft Solutions Partner — Security, Modern Work, Infrastructure, App Innovation, Data & AI● Microsoft partner since 2006◆ 1,100+ organizations under management
Home/Services/Migrate to Microsoft 365/GoDaddy Microsoft 365 Defederation & Tenant Takeover
Migration

GoDaddy Microsoft 365 Defederation & Tenant Takeover

GoDaddy Microsoft 365 Defederation & Tenant Takeover moves your Microsoft 365 tenant out from under GoDaddy's control — without migrating anywhere. IT Partner plans and executes the defederation: the domain is converted from GoDaddy's federated sign-on to standard Microsoft Entra managed sign-in, every user receives a new password that we prepare in advance and set ourselves the moment the domain converts, GoDaddy's delegated administration is removed from the tenant, replacement licensing is switched as the last step, and billing moves to a direct Microsoft relationship through IT Partner as your CSP. GoDaddy's support is not needed to remove the federation; once it is removed, we work with GoDaddy to cancel the old licenses. Your mailboxes, files, and Teams stay exactly where they are — you keep the tenant, you lose the middleman.

Timeline 1 weekService owner Roman SotnikEntra IDGoDaddy Microsoft 365Microsoft 365

What this engagement is

Microsoft 365 bought through GoDaddy is not quite yours. GoDaddy provisions the tenant with its own federated sign-on, holds delegated administrative access, controls the billing relationship, and limits which admin capabilities you can reach. Leaving that arrangement is called defederation — and done casually, it locks every user out of email at once. This service is the careful version. IT Partner converts your domain from GoDaddy's federated authentication to standard Microsoft Entra managed sign-in, resets the password of every user the moment the domain converts, takes over global administration, removes GoDaddy's delegated access from the tenant, switches licensing to a direct Microsoft relationship as the last step, and closes out the GoDaddy subscriptions only after the tenant is verifiably self-sufficient. GoDaddy's support is not needed to remove the federation: we work directly with you to reach an admin account in the tenant and do that part inside Microsoft Entra. GoDaddy comes in afterwards, when we work with them to cancel the licenses, using the delegated admin access to your GoDaddy account that we ask for as the first step of the engagement. Unlike a tenant-to-tenant migration, nothing moves: mailboxes, OneDrive files, SharePoint sites, and Teams all stay in place, because the tenant was always yours — only the sign-in path, administration, and billing change hands. If you would rather consolidate into a different existing tenant, the sibling service GoDaddy Microsoft 365 to Microsoft 365 Tenant-to-Tenant Cutover Email Migration covers that path instead; we help you choose in the first call.

Success criteria

01Replacement Microsoft 365 licensing is switched as the last step of the engagement, with no coverage gap for any user.
02The custom domain authenticates through standard Microsoft Entra managed sign-in; GoDaddy federated sign-on is fully removed.
03Every user has a new password, reset by us the moment the domain converts from the list prepared with you in advance, and signs in again on their devices.
04Security defaults, which enforce Microsoft MFA, are confirmed enabled in the tenant (turned on by us if they were off); users who had no MFA before the defederation register their MFA methods at the next sign-in.
05The client holds Global Administrator control of the tenant, and GoDaddy delegated administrative access is removed.
06Nothing is migrated and nothing moves: mailboxes, OneDrive, SharePoint, and Teams stay where they are, and mail flow is verified after the cutover, with MX records changed only where GoDaddy's email security add-on was in front of the mailboxes.
07GoDaddy Microsoft 365 licenses are cancelled with GoDaddy only after license replacement and tenant control are verified, and billing runs through the new direct relationship.

What you receive

✓Defederation readiness assessment: current GoDaddy subscriptions and licensing, domain and DNS state (including whether MX records point at GoDaddy's email security add-on), user inventory, whether security defaults are enabled, and delegated-administration relationships.
✓Cutover plan with sequencing, rollback points, and a change window agreed with you during business hours; an after-hours window is available at the hourly rate, three hours minimum ($175 per hour), quoted in advance.
✓Replacement licensing staged through IT Partner as CSP (or your chosen direct agreement) and assigned as the last step, once the tenant is verified self-sufficient.
✓Domain authentication converted from GoDaddy federation to Microsoft Entra managed sign-in, with every domain on the tenant converted in the same run.
✓A password plan: new passwords prepared with you in advance and reset by us in bulk the moment the domain converts, with a change at first sign-in enforced. Signing in again on each device, and registering MFA methods where prompted, is each user's own task; we step in when something breaks.
✓Global Administrator takeover documented and GoDaddy delegated access removed from the tenant; security defaults confirmed enabled so MFA is enforced.
✓GoDaddy license cancellation handled with GoDaddy after verification, and a closeout report covering final state, acceptance criteria, and any outstanding items.

How the work unfolds

Assessment and plan

Request delegated admin access to your GoDaddy account as the first step; inventory GoDaddy subscriptions, licensing, every domain on the tenant, users, MX records, the security defaults state and delegated access; agree the cutover window; prepare the new passwords with you.

Defederation cutover

Convert every domain from GoDaddy federated sign-on to Microsoft Entra managed authentication in the agreed window, reset the password of every user immediately from the prepared list, and change MX records where GoDaddy's email security add-on was in front of the mailboxes.

Takeover and cleanup

Confirm Global Administrator control, remove GoDaddy delegated administration from the tenant, confirm security defaults are enabled (and enable them if they were off), and verify mail flow.

License switch

Purchase and assign replacement Microsoft 365 licenses as the last step, once the tenant is verified self-sufficient — no user has a coverage gap at any point. This step usually takes longer than the conversion itself.

Closeout

Work with GoDaddy to cancel the Microsoft 365 licenses after verification, confirm billing on the new relationship, and deliver the closeout report.

Prerequisites

→An admin account in the tenant. GoDaddy's support is not needed for this: we work directly with you to reach Global Administrator access, starting from the GoDaddy-provided admin credentials or an admin account you already hold.
→Delegated admin access to your GoDaddy account, which we ask for as the first step of the engagement; the domain itself can remain registered at GoDaddy.
→Authority to purchase replacement Microsoft 365 licensing before the GoDaddy licenses are cancelled, and approval for us to cancel them with GoDaddy when the tenant is verified self-sufficient.

Who does what

IT Partner

  • Lead the readiness assessment, cutover plan, and change-window scheduling
  • Purchase and assign replacement licensing as the last step, after tenant control is verified
  • Execute the domain authentication conversion and reset the password of every user from the prepared list
  • Take over and document tenant administration, remove GoDaddy delegated access from the tenant, and confirm security defaults are enabled
  • Verify mail flow after the cutover
  • Work with GoDaddy to cancel the Microsoft 365 licenses after verification and deliver the closeout report

Your team

  • Work with us to reach an admin account in the tenant, grant delegated admin access to your GoDaddy account as the first step, and approve the password plan
  • Approve the replacement licensing purchase and the cutover window
  • Inform your users and hand them their new passwords; each user signs in again on their own devices and registers MFA methods where prompted (we step in when something breaks)
  • Provide a dedicated point of contact during the cutover window
  • Approve the cancellation of the GoDaddy licenses when told, and review and approve engagement deliverables in a timely manner

What's not included

✕Tenant-to-tenant data migration — if you are consolidating into another existing tenant, that is the sibling service GoDaddy Microsoft 365 to Microsoft 365 Tenant-to-Tenant Cutover Email Migration.
✕Domain transfer away from GoDaddy's registrar, website or hosting moves, and non-Microsoft services in the GoDaddy account — the domain can stay registered at GoDaddy throughout.
✕User communication — announcements, templates and the hand-out of the new passwords are the client's; we provide the passwords and the sequence.
✕Hands-on re-sign-in and MFA registration on each user's devices — that is each user's own task; we help when something breaks.
✕Verification beyond mail flow — shared mailbox and alias access, calendars and data checks are not part of the cutover validation, because nothing is migrated.
✕A post-cutover security review, Conditional Access design, Intune rollout, and security baselines — separately scoped follow-on work; the defederation confirms security defaults are enabled and nothing more.
✕Ongoing administration and end-user support after the closeout report, unless separately contracted.

Limitations & technical notes

!Sequencing is everything in a defederation: the authentication conversion and the password reset are verified first, then GoDaddy's delegated access is removed, and replacement licenses are in place before any GoDaddy license is cancelled. This service exists because doing those steps out of order locks users out of email or, at worst, loses mailbox data when a subscription lapses.
!Every user receives a new password, and we are the ones who set it: no password is created automatically when a federated domain becomes managed. We prepare the passwords with you in advance and reset every account the moment the domain converts, so the only thing users do is sign in again.
!MFA after defederation is Microsoft MFA; there is no separate GoDaddy MFA to carry over. We check that security defaults, which enforce MFA, are enabled in the tenant and turn them on if they were off. Depending on whether MFA was enabled before the defederation, users may be asked to register their MFA methods at the next sign-in.
!Mail keeps flowing throughout. MX records do not change unless your GoDaddy plan included GoDaddy's email security add-on, in which case they point at that filtering service and are changed to Microsoft's as part of the plan. Mail flow is the only thing verified after the cutover; nothing else moves.
!The cutover runs during business hours. An after-hours window is available at the hourly rate with a three-hour minimum ($175 per hour), quoted in advance.
!The engagement restores your tenant to standard Microsoft sign-in and direct control; it does not change your data, mailboxes, or configuration beyond authentication, administration, and billing. Elapsed time depends on the tenant and on the licensing switch, which usually takes longer than the conversion itself.
!Technical content reviewed October 2026 by the engineer who runs these projects: GoDaddy's support is not needed to remove the federation and is involved only afterwards, to cancel the licenses; every user's password is reset by us; MFA is Microsoft MFA through security defaults; MX records can change where GoDaddy's email security add-on was in use.

Frequently asked questions

What does GoDaddy defederation actually mean?

Microsoft 365 sold through GoDaddy uses GoDaddy's own federated sign-on: your users authenticate through GoDaddy's identity system, not directly with Microsoft. Defederation converts your domains back to standard Microsoft Entra managed authentication, so sign-in, administration, and billing no longer route through GoDaddy. Your tenant, mailboxes, and files never move — they were always in Microsoft's cloud; what changes is who controls the front door.

Do we need to open a ticket with GoDaddy?

Not to remove the federation. We work directly with you to reach an admin account in the tenant, starting from the GoDaddy-provided admin credentials or an admin account you already hold, and the conversion, the password reset and the takeover happen inside Microsoft Entra. GoDaddy comes in afterwards: once the federation is removed and the replacement licensing is in place, we work with GoDaddy to cancel the Microsoft 365 licenses, using the delegated admin access to your GoDaddy account that we ask for as the first step.

Will we lose email or files?

No — provided the sequencing is right, which is the core of this service. Mailboxes, OneDrive, SharePoint, and Teams stay exactly where they are and mail keeps arriving throughout. MX records change only if your GoDaddy plan included GoDaddy's email security add-on, which sits in front of the mailboxes; the plan switches them to Microsoft's, and mail flow is verified after the cutover. Replacement licenses are assigned as the last step but before anything is cancelled, and the GoDaddy licenses are cancelled only after the tenant is verified self-sufficient.

Do users keep their passwords?

No. In a GoDaddy tenant the password lives in GoDaddy's identity service, so once the domain becomes managed every account needs a password set in Microsoft Entra. Nothing creates one automatically: we prepare the new passwords with you in advance, reset every account the moment the domain converts, and enforce a change at first sign-in.

What do our users experience on cutover day?

A new password and a sign-in on each device: Outlook, the Office apps, and their phones ask them to sign in again. Depending on whether MFA was enabled before the defederation, they may also be asked to register their MFA methods, since a defederated tenant uses Microsoft MFA with security defaults on. Their email address, mailbox, files, and Teams are untouched. You announce the switch and hand out the passwords; signing in again is each user's own task, and we step in when something breaks.

Can the cutover run outside business hours?

Yes, as a priced option. The engagement price covers a window during business hours; an after-hours window is billed at the hourly rate with a three-hour minimum ($175 per hour) and quoted in advance.

Do we have to move our domain away from GoDaddy?

No. The domain can stay registered at GoDaddy indefinitely — domain registration and Microsoft 365 federation are separate things. Only the Microsoft 365 sign-on, administration, and billing relationships change.

How is this different from your GoDaddy tenant-to-tenant migration service?

Defederation keeps your existing tenant and removes GoDaddy's control of it — nothing migrates. The tenant-to-tenant cutover migration moves your mailboxes into a different tenant, which is the right path when you are consolidating with another organization or want a fresh start. Most GoDaddy customers only need defederation; we confirm which fits in the first call.

What happens to our Microsoft 365 licenses and billing?

Your GoDaddy-billed subscriptions are replaced with direct Microsoft licensing — typically through IT Partner as your Cloud Solution Provider at the same Microsoft price, or another direct agreement if you prefer. The license switch is the last step of the engagement, made once the tenant is verified self-sufficient so there is no coverage gap, and GoDaddy billing ends when its subscriptions are closed out. This step usually takes longer than the conversion itself.

Why not just call GoDaddy and cancel?

Because cancelling first is the disaster path: when a GoDaddy Microsoft 365 subscription lapses before licenses are replaced and federation is removed, users lose access and mailbox data is at risk. Defederation done safely is a sequence — convert authentication and reset the passwords first, take over administration second, switch licenses as the last step, and only then cancel the GoDaddy licenses, which we do with GoDaddy — and that sequence is exactly what this engagement delivers.

Will this allow me to get admin functionality to use AI tools like Claude to create, send and edit emails?

Yes. Once your GoDaddy Microsoft 365 tenant is defederated, you'll gain direct administrative control of the tenant, including the ability to assign Global Administrator permissions, manage applications and integrations, and fully configure Microsoft 365 services without GoDaddy acting as an intermediary. You'll also have access to the full range of Microsoft 365 products and services available in the United States. In many cases, direct CSP partners like us can provide licensing options and specialized SKUs that aren't available through GoDaddy, and some offerings are only available through Microsoft's CSP channel. After the migration, GoDaddy is removed from the tenant entirely. You'll own the tenant directly, control all administrator accounts, and manage your Microsoft relationship without the limitations, restrictions, or administrative barriers commonly associated with GoDaddy-managed Microsoft 365 environments. For AI solutions such as Claude, Microsoft Copilot, and other third-party integrations, you'll have the administrative flexibility needed to configure and manage them according to each vendor's requirements, subject to the capabilities and permissions those solutions require.

Didn’t find your question?

Ask it here. A real engineer answers by email within one business day — and if it’s a good one, it becomes part of this page so the next person finds it.

Answered by a person, one time, to your inbox. Nothing you type here is published without a human reviewing and anonymizing it first.

Related services

Licences this pairs with

$525 per project
1 week
Book a defederation call