01 — Overview
What this engagement is
Microsoft 365 bought through GoDaddy is not quite yours. GoDaddy provisions the tenant with its own federated sign-on, holds delegated administrative access, and limits which admin capabilities you can reach. Leaving that arrangement is called defederation — and done casually, it locks every user out of email at once.
This service is the careful version. IT Partner converts your domain from GoDaddy's federated authentication to standard Microsoft Entra managed sign-in, resets the password of every user the moment the domain converts, takes over global administration, and removes GoDaddy's delegated access from the tenant. GoDaddy's support is not needed to remove the federation: we work directly with you to reach an admin account in the tenant and do that part inside Microsoft Entra.
Who sells you the licenses is a separate question, and changing it is not required. Control of the tenant comes from the defederation and the admin takeover, not from where the licenses are bought — moving your licensing away from GoDaddy does not by itself give you admin control, and keeping GoDaddy as your reseller does not take it away. You have three options: keep your GoDaddy licenses until their current term ends — they keep working, but GoDaddy cannot renew them once the tenant is defederated, so they must be replaced before they expire; switch them to IT Partner as your Cloud Solution Provider, in which case we help with the transition and coordinate the GoDaddy cancellation; or buy licenses directly from Microsoft, in which case the purchase, assignment, and GoDaddy cancellation are yours and outside this project.
Unlike a tenant-to-tenant migration, nothing moves: mailboxes, OneDrive files, SharePoint sites, and Teams all stay in place, because the tenant was always yours — only the sign-in path and administration change hands. If you would rather consolidate into a different existing tenant, the sibling service GoDaddy Microsoft 365 to Microsoft 365 Tenant-to-Tenant Cutover Email Migration covers that path instead; we help you choose in the first call.
02 — Outcomes
Success criteria
01The custom domain authenticates through standard Microsoft Entra managed sign-in; GoDaddy federated sign-on is fully removed.
02The client holds Global Administrator control of the tenant, and GoDaddy delegated administrative access is removed.
03Every user has a new password, reset by us the moment the domain converts from the list prepared with you in advance, and signs in again on their devices.
04Security defaults, which enforce Microsoft MFA, are confirmed enabled in the tenant (turned on by us if they were off); users who had no MFA before the defederation register their MFA methods at the next sign-in.
05Nothing is migrated and nothing moves: mailboxes, OneDrive, SharePoint, and Teams stay where they are, and mail flow is verified after the cutover, with MX records changed only where GoDaddy's email security add-on was in front of the mailboxes.
06Licensing stays with the provider you choose. If you switch to IT Partner as your CSP, replacement licenses are in place with no coverage gap for any user before the GoDaddy licenses are cancelled; if you keep GoDaddy licenses (which run until their term ends and cannot be renewed) or buy directly from Microsoft, no license changes are made as part of the project.
03 — Deliverables
What you receive
✓Defederation readiness assessment: current GoDaddy subscriptions and licensing, including each license's term end date, domain and DNS state (including whether MX records point at GoDaddy's email security add-on), user inventory, whether security defaults are enabled, and delegated-administration relationships.
✓Cutover plan with sequencing, rollback points, and a change window agreed with you during business hours; an after-hours window is available at the hourly rate, three hours minimum ($175 per hour), quoted in advance.
✓Domain authentication converted from GoDaddy federation to Microsoft Entra managed sign-in, with every domain on the tenant converted in the same run.
✓A password plan: new passwords prepared with you in advance and reset by us in bulk the moment the domain converts, with a change at first sign-in enforced. Signing in again on each device, and registering MFA methods where prompted, is each user's own task; we step in when something breaks.
✓Global Administrator takeover documented and GoDaddy delegated access removed from the tenant; security defaults confirmed enabled so MFA is enforced.
✓Optional licensing transition, only if you choose IT Partner as your CSP: replacement licenses purchased and assigned once the tenant is verified self-sufficient, and the GoDaddy licenses cancelled with GoDaddy afterwards. If you keep GoDaddy licensing or buy directly from Microsoft, this deliverable does not apply.
✓A closeout report covering final state, acceptance criteria, your licensing status (including the expiry dates of any GoDaddy licenses you kept), and any outstanding items.
04 — Plan
How the work unfolds
Assessment and plan
Request delegated admin access to your GoDaddy account as the first step; inventory GoDaddy subscriptions, licensing, every domain on the tenant, users, MX records, the security defaults state and delegated access; confirm your licensing choice; agree the cutover window; prepare the new passwords with you.
Defederation cutover
Convert every domain from GoDaddy federated sign-on to Microsoft Entra managed authentication in the agreed window, reset the password of every user immediately from the prepared list, and change MX records where GoDaddy's email security add-on was in front of the mailboxes.
Takeover and cleanup
Confirm Global Administrator control, remove GoDaddy delegated administration from the tenant, confirm security defaults are enabled (and enable them if they were off), and verify mail flow.
Licensing transition (optional)
Only if you switch licensing to IT Partner as your CSP: purchase and assign replacement Microsoft 365 licenses once the tenant is verified self-sufficient, so no user has a coverage gap, then work with GoDaddy to cancel the old licenses. This step usually takes longer than the conversion itself. If you keep GoDaddy licensing or buy directly from Microsoft, this milestone is skipped.
Closeout
Deliver the closeout report, including the final state of the tenant and your licensing status, with the expiry dates of any GoDaddy licenses you kept.
05 — Before we start
Prerequisites
→An admin account in the tenant. GoDaddy's support is not needed for this: we work directly with you to reach Global Administrator access, starting from the GoDaddy-provided admin credentials or an admin account you already hold.
→Delegated admin access to your GoDaddy account, which we ask for as the first step of the engagement; the domain itself can remain registered at GoDaddy.
→A licensing decision: keep GoDaddy licenses until their term ends (they cannot be renewed after defederation), switch to IT Partner as your CSP, or buy directly from Microsoft. Only if you switch to IT Partner: authority to purchase the replacement licensing and approval for us to cancel the GoDaddy licenses once the tenant is verified self-sufficient.
06 — Working together
Who does what
IT Partner
- Lead the readiness assessment, cutover plan, and change-window scheduling
- Execute the domain authentication conversion and reset the password of every user from the prepared list
- Take over and document tenant administration, remove GoDaddy delegated access from the tenant, and confirm security defaults are enabled
- Verify mail flow after the cutover
- If you switch licensing to IT Partner: purchase and assign replacement licenses after tenant control is verified, and work with GoDaddy to cancel the old licenses
- Deliver the closeout report
Your team
- Work with us to reach an admin account in the tenant, grant delegated admin access to your GoDaddy account as the first step, and approve the password plan
- Choose how you license Microsoft 365 going forward and approve the cutover window; if you buy directly from Microsoft, purchase, assign, and cancel licenses yourself
- Inform your users and hand them their new passwords; each user signs in again on their own devices and registers MFA methods where prompted (we step in when something breaks)
- Provide a dedicated point of contact during the cutover window
- Review and approve engagement deliverables in a timely manner
07 — Scope
What's not included
✕Tenant-to-tenant data migration — if you are consolidating into another existing tenant, that is the sibling service GoDaddy Microsoft 365 to Microsoft 365 Tenant-to-Tenant Cutover Email Migration.
✕Licensing changes you make yourself — buying licenses directly from Microsoft, assigning them, and cancelling the GoDaddy licenses in that case are the client's. Keeping GoDaddy licensing requires no license work during the project, but those licenses cannot be renewed after defederation, so replacing them before they expire is the client's — either directly with Microsoft or by switching to IT Partner later.
✕Domain transfer away from GoDaddy's registrar, website or hosting moves, and non-Microsoft services in the GoDaddy account — the domain can stay registered at GoDaddy throughout.
✕User communication — announcements, templates and the hand-out of the new passwords are the client's; we provide the passwords and the sequence.
✕Hands-on re-sign-in and MFA registration on each user's devices — that is each user's own task; we help when something breaks.
✕Verification beyond mail flow — shared mailbox and alias access, calendars and data checks are not part of the cutover validation, because nothing is migrated.
✕A post-cutover security review, Conditional Access design, Intune rollout, and security baselines — separately scoped follow-on work; the defederation confirms security defaults are enabled and nothing more.
✕Ongoing administration and end-user support after the closeout report, unless separately contracted.
08 — Fine print
Limitations & technical notes
!Sequencing is everything in a defederation: the authentication conversion and the password reset are verified first, then GoDaddy's delegated access is removed. If licensing moves away from GoDaddy, replacement licenses must be in place before any GoDaddy license is cancelled. Doing those steps out of order locks users out of email or, at worst, loses mailbox data when a subscription lapses.
!Licensing and tenant control are separate. Moving away from GoDaddy as your license reseller is not required for the defederation, and it does not by itself give you admin control of the tenant — the defederation and Global Administrator takeover do. You can keep GoDaddy licenses until their current term ends, switch to IT Partner with our help during the transition, or buy directly from Microsoft on your own. GoDaddy licenses cannot be renewed once the tenant is defederated: they keep working until they expire, and they must be replaced before then, or users lose access and mailbox data is at risk.
!Every user receives a new password, and we are the ones who set it: no password is created automatically when a federated domain becomes managed. We prepare the passwords with you in advance and reset every account the moment the domain converts, so the only thing users do is sign in again.
!MFA after defederation is Microsoft MFA; there is no separate GoDaddy MFA to carry over. We check that security defaults, which enforce MFA, are enabled in the tenant and turn them on if they were off. Depending on whether MFA was enabled before the defederation, users may be asked to register their MFA methods at the next sign-in.
!Mail keeps flowing throughout. MX records do not change unless your GoDaddy plan included GoDaddy's email security add-on, in which case they point at that filtering service and are changed to Microsoft's as part of the plan. Mail flow is the only thing verified after the cutover; nothing else moves.
!The cutover runs during business hours. An after-hours window is available at the hourly rate with a three-hour minimum ($175 per hour), quoted in advance.
!The engagement restores your tenant to standard Microsoft sign-in and direct control; it does not change your data, mailboxes, or configuration beyond authentication and administration. Elapsed time depends on the tenant and, if you switch licensing to IT Partner, on the licensing transition, which usually takes longer than the conversion itself.
!Technical content reviewed October 2026 by the engineer who runs these projects: GoDaddy's support is not needed to remove the federation; every user's password is reset by us; MFA is Microsoft MFA through security defaults; MX records can change where GoDaddy's email security add-on was in use; changing the license reseller is optional and separate from tenant control; GoDaddy licenses work until their term ends but cannot be renewed after defederation.
09 — Questions
Frequently asked questions
What does GoDaddy defederation actually mean?
Microsoft 365 sold through GoDaddy uses GoDaddy's own federated sign-on: your users authenticate through GoDaddy's identity system, not directly with Microsoft. Defederation converts your domains back to standard Microsoft Entra managed authentication, so sign-in and administration no longer route through GoDaddy. Your tenant, mailboxes, and files never move — they were always in Microsoft's cloud; what changes is who controls the front door.
Do we need to open a ticket with GoDaddy?
Not to remove the federation. We work directly with you to reach an admin account in the tenant, starting from the GoDaddy-provided admin credentials or an admin account you already hold, and the conversion, the password reset and the takeover happen inside Microsoft Entra. GoDaddy only comes in if you switch your licensing to IT Partner: then we work with GoDaddy to cancel the old licenses once the replacements are in place, using the delegated admin access to your GoDaddy account that we ask for as the first step.
Do we have to stop buying Microsoft 365 licenses from GoDaddy?
No. Defederation does not require a license change, and changing your reseller is not what gives you control of the tenant — the defederation and the Global Administrator takeover do. You can keep your GoDaddy licenses until their current term ends, switch them to IT Partner as your Cloud Solution Provider and we help you through the transition, or buy directly from Microsoft, which you handle yourself outside this project. Keep in mind that GoDaddy cannot renew its licenses once the tenant is defederated, so if you keep them, plan their replacement before they expire.
Will we lose email or files?
No — provided the sequencing is right, which is the core of this service. Mailboxes, OneDrive, SharePoint, and Teams stay exactly where they are and mail keeps arriving throughout. MX records change only if your GoDaddy plan included GoDaddy's email security add-on, which sits in front of the mailboxes; the plan switches them to Microsoft's, and mail flow is verified after the cutover. If you move licensing away from GoDaddy, replacement licenses must be assigned before any GoDaddy license is cancelled.
Do users keep their passwords?
No. In a GoDaddy tenant the password lives in GoDaddy's identity service, so once the domain becomes managed every account needs a password set in Microsoft Entra. Nothing creates one automatically: we prepare the new passwords with you in advance, reset every account the moment the domain converts, and enforce a change at first sign-in.
What do our users experience on cutover day?
A new password and a sign-in on each device: Outlook, the Office apps, and their phones ask them to sign in again. Depending on whether MFA was enabled before the defederation, they may also be asked to register their MFA methods, since a defederated tenant uses Microsoft MFA with security defaults on. Their email address, mailbox, files, and Teams are untouched. You announce the switch and hand out the passwords; signing in again is each user's own task, and we step in when something breaks.
Can the cutover run outside business hours?
Yes, as a priced option. The engagement price covers a window during business hours; an after-hours window is billed at the hourly rate with a three-hour minimum ($175 per hour) and quoted in advance.
Do we have to move our domain away from GoDaddy?
No. The domain can stay registered at GoDaddy indefinitely — domain registration and Microsoft 365 federation are separate things. Only the Microsoft 365 sign-on and administration change.
How is this different from your GoDaddy tenant-to-tenant migration service?
Defederation keeps your existing tenant and removes GoDaddy's control of it — nothing migrates. The tenant-to-tenant cutover migration moves your mailboxes into a different tenant, which is the right path when you are consolidating with another organization or want a fresh start. Most GoDaddy customers only need defederation; we confirm which fits in the first call.
What happens to our Microsoft 365 licenses and billing?
That is up to you. If you keep your GoDaddy licenses, they keep working until their current term ends, but they cannot be renewed after defederation — you need replacement licenses in place before they expire, either from IT Partner or directly from Microsoft. If you switch to IT Partner as your Cloud Solution Provider, we help with the transition: replacement licenses at the same Microsoft price are assigned once the tenant is verified self-sufficient, so there is no coverage gap, and then we work with GoDaddy to cancel the old licenses — this step usually takes longer than the conversion itself. If you buy directly from Microsoft, the purchase, assignment, and GoDaddy cancellation are yours and not part of the project.
Why not just call GoDaddy and cancel?
Because cancelling first is the disaster path: when a GoDaddy Microsoft 365 subscription lapses before licenses are replaced and federation is removed, users lose access and mailbox data is at risk. Cancelling also does not give you control of the tenant — the defederation does. Done safely, the sequence is: convert authentication and reset the passwords first, take over administration second, and only if you are leaving GoDaddy licensing, put replacement licenses in place before any GoDaddy license is cancelled.
Will this allow me to get admin functionality to use AI tools like Claude to create, send and edit emails?
Yes. Once your GoDaddy Microsoft 365 tenant is defederated, you'll gain direct administrative control of the tenant, including the ability to assign Global Administrator permissions, manage applications and integrations, and fully configure Microsoft 365 services without GoDaddy acting as an intermediary.
You'll also have access to the full range of Microsoft 365 products and services available in the United States. In many cases, direct CSP partners like us can provide licensing options and specialized SKUs that aren't available through GoDaddy, and some offerings are only available through Microsoft's CSP channel.
After the migration, GoDaddy is removed from the tenant entirely. You'll own the tenant directly, control all administrator accounts, and manage your Microsoft relationship without the limitations, restrictions, or administrative barriers commonly associated with GoDaddy-managed Microsoft 365 environments.
For AI solutions such as Claude, Microsoft Copilot, and other third-party integrations, you'll have the administrative flexibility needed to configure and manage them according to each vendor's requirements, subject to the capabilities and permissions those solutions require.
Licences
Licences this pairs with