Free a GoDaddy 365 Tenant Without Migrating: A Defederation Playbook

A customer who bought their Microsoft 365 subscription direct from GoDaddy, bundled with their primary domain, comes with a hidden lock: GoDaddy federates that domain and tenant, which makes it impossible to transfer under CSP or Direct to Microsoft. Moving and defederating that account has long been a point of confusion and pain. This playbook walks the defederation end to end, with the scripts you need.

What this approach gets you:

• Defederate the tenant without migrating.
• Never have to call GoDaddy.
• Keep user accounts instead of deleting them.
• No downtime.

The high-level sequence:

• A. Prepare your end users
• B. Become a tenant admin in GoDaddy
• C. Remove federation with GoDaddy
• D. Reset users' passwords
• E. Add a CSP provider or move Direct to Microsoft
• F. Provision licensing into the account
• G. Remove GoDaddy as delegated admin and remove the enterprise app
• H. Cancel the GoDaddy subscription

Prepare your end users#

Defederating requires users to reset their passwords before they can sign in again. Have a password list ready to distribute, collect passwords from users beforehand, or reset everyone to a temporary password after defederation and let them change it. There is a bulk script later in this post for the reset.

Pick a date and time for the cutover. We recommend non-business hours even though there is no mail-flow downtime. Tell users when it will happen.

Users may hit activation prompts in their Office apps and Outlook during the license transition, so give them sign-in instructions. For Office apps: File > Account > Sign Out > Sign In. In Outlook, users are prompted to re-enter their new password after it changes:

Become a tenant admin in GoDaddy#

When a user sets up a 365 account directly with GoDaddy, the initial "admin" user is redirected to the GoDaddy portal whenever they try to reach the admin tab from Office.com. So you need access to the true Global Admin to run the defederation scripts.

1. Log in to Portal.Azure.com with the admin user created when the account was set up, and click the three lines in the top-left corner.
2. Click Azure Active Directory, then Users.
3. Look for a user labeled admin@<randomname>.onmicrosoft.com:

1. Click this user and reset their password. If you already have access to this user, skip this step.
2. Copy the temporary password into a notepad, open an incognito browser window, go to office.com, and sign in with that username and temporary password. Set a new password. You now have a user that can run the PowerShell commands in the next steps.

Remove federation with GoDaddy#

Be aware: Before this step, make sure all users have the passwords you will be resetting. They will not be able to sign in without the new password.

Run PowerShell as administrator. These cmdlets defederate the tenant:

Write-Host "Checking for MSGraph module..."

$Module = Get-Module -Name "Microsoft.Graph.Identity.DirectoryManagement" -ListAvailable

if ($Module -eq $null) {

        Write-Host "MSGraph module not found, installing MSGraph"
        Install-Module -name Microsoft.Graph.Identity.DirectoryManagement

    }
Connect-MgGraph -Scopes "Directory.Read.All","Domain.Read.All","Domain.ReadWrite.All","Directory.AccessAsUser.All"
#Enter the Admin credentials from "Become a tenant Admin in GoDaddy"

Get-MgDomain
#See that the domain is "federated"#

Update-MgDomain -DomainId "<InsertFederatedDomain>" -Authentication Managed

A DomainId looks like tminus365.com, the domain listed as federated that you want to convert to managed. After this completes you get a new command line. Run Get-MgDomain again and the domain shows as "managed."

Please note: ALL domains in the tenant must be in a managed state for this to work correctly, even one that is no longer in use.

Supporting cmdlet docs:

• Get started: Microsoft Graph PowerShell SDK (opens in new tab)
• Get domain: Get-MgDomain (opens in new tab)
• Update domain: Update-MgDomain (opens in new tab)

Reset users' passwords#

For a small account, reset users one at a time: sign in to office.com as the admin from the previous step and, now that the tenant is defederated, click into the admin tile and the Users section. For larger accounts, bulk update from a CSV.

Single user update:

# --- Load Graph modules ---
Import-Module Microsoft.Graph.Users -ErrorAction Stop
Import-Module Microsoft.Graph.Authentication -ErrorAction Stop

# --- Connect to Graph ---
Write-Host "Connecting to Microsoft Graph..." -ForegroundColor Cyan
Connect-MgGraph -Scopes "User.ReadWrite.All"

$passwordProfile = @{
    Password                      = '<InsertPassword>'
    ForceChangePasswordNextSignIn = $true   # optional
}

Update-MgUser -UserId 'example@domain.com' -PasswordProfile $passwordProfile

Multi-user update. First, build a CSV like this:

UserPrincipalName,NewPassword
alice@contoso.com,P@ssw0rd123!
bob@contoso.com,Secur3Pwd!
charlie@contoso.com,Hada9200!

• UserPrincipalName is the UPN / sign-in name of the user.
• NewPassword is the new password you want to assign.

Then run the bulk script:

<#
.SYNOPSIS
Bulk reset user passwords in Entra ID using Microsoft Graph.

.DESCRIPTION
Imports a CSV of users and sets each account's passwordProfile.Password.
Requires: Microsoft.Graph module and User.ReadWrite.All (or Directory.AccessAsUser.All).

.PARAMETER CsvPath
Path to the CSV file containing UserPrincipalName and NewPassword columns.
#>

param(
[Parameter(Mandatory = $true)]
[string]$CsvPath
)

# --- Load Graph modules ---
Import-Module Microsoft.Graph.Users -ErrorAction Stop
Import-Module Microsoft.Graph.Authentication -ErrorAction Stop

# --- Connect to Graph ---
Write-Host "Connecting to Microsoft Graph..." -ForegroundColor Cyan
Connect-MgGraph -Scopes "User.ReadWrite.All"

# --- Import CSV ---
if (-not (Test-Path $CsvPath)) {
throw "CSV file not found at path: $CsvPath"
}

$users = Import-Csv -Path $CsvPath

if (-not $users) {
throw "CSV file '$CsvPath' contains no rows."
}

Write-Host "Processing $($users.Count) users from CSV..." -ForegroundColor Cyan

$results = @()

foreach ($user in $users) {
$upn = $user.UserPrincipalName
$newPassword = $user.NewPassword

if ([string]::IsNullOrWhiteSpace($upn) -or [string]::IsNullOrWhiteSpace($newPassword)) {
Write-Warning "Skipping row with missing UserPrincipalName or NewPassword."
continue
}

$passwordProfile = @{
Password = $newPassword
ForceChangePasswordNextSignIn = $true # set to $false if you don't want this
}

try {
Write-Host "Updating password for $upn ..." -ForegroundColor Yellow

Update-MgUser -UserId $upn -PasswordProfile $passwordProfile

$results += [pscustomobject]@{
UserPrincipalName = $upn
Status = "Success"
Error = $null
}
}
catch {
Write-Warning "Failed to update password for $upn : $($_.Exception.Message)"
$results += [pscustomobject]@{
UserPrincipalName = $upn
Status = "Failed"
Error = $_.Exception.Message
}
}
}

# --- Output summary ---
Write-Host ""
Write-Host "Bulk password reset completed." -ForegroundColor Green

$results | Format-Table -AutoSize

# Optionally export results to CSV:
# $results | Export-Csv -Path ".\PasswordResetResults.csv" -NoTypeInformation

If you would rather avoid PowerShell entirely, you can reset passwords one by one in the Entra Admin Center (opens in new tab) under Users > Select User > Reset Password.

Add a new provider and provision licensing#

With the tenant defederated, add a CSP provider via their delegated admin link, or go Direct to Microsoft for licensing.

Check whether the existing GoDaddy plan includes email security. GoDaddy bundles Proofpoint with some email-security products, which requires extra DNS work. See the email security note below.

For CSP: Paste the delegated admin link in a browser and sign in to the tenant with the Global Admin credentials if you are not already. Accept the relationship, reload, and the new CSP appears. Order licensing for the customer. If you are not changing the subscription, provision the same number of seats you have today, remove GoDaddy as delegated admin, and cancel with GoDaddy. License ownership transfers with no downtime. If you are changing the subscriptions (for example, Business Standard to Business Premium):

1. Order the licensing from CSP.
2. Confirm the licensing is provisioned in the tenant under Billing > Your Products.
3. Go to Users > Active Users and bulk-assign the new CSP licensing while unassigning the GoDaddy licensing.

For Microsoft Direct:

1. In the Microsoft Admin Portal (opens in new tab), go to Billing > Purchase Services.
2. Purchase the licensing you want.
3. Follow the same steps as CSP to assign licenses if you changed the subscription type.

Email security (Proofpoint considerations)#

If the GoDaddy plan includes email security, they layer in Proofpoint, which redirects mail flow to their portal via the MX record. If you have this plan and do not change the MX records after cancellation, email will go down. If you do not have one of these plans, skip this section.

Where to check: Go to My Account | Billing (opens in new tab) in GoDaddy and look for a subscription with email + security. Examples:

Updating your DNS records: The Domain section of GoDaddy hosts your DNS records:

There you find the Proofpoint MX records:

You have two options: update the records manually in GoDaddy, or use the "Add DNS Records for me" function in the Microsoft Admin Portal. Either way, go to the tenant's domains page (opens in new tab) to find the MX record to set in GoDaddy:

Update the existing MX record in GoDaddy and delete the other two.

Remove GoDaddy as delegated admin#

In the 365 Admin Portal, go to Settings > Partner Relationships > click GoDaddy > Roles > remove their roles:

Remove the Partner Center Web App#

GoDaddy also has an enterprise app, "Partner Center Web App," that can perform write activity even after GDAP is removed. Delete it from the Enterprise apps section in Entra.

1. Go to entra.microsoft.com (opens in new tab) as an admin.
2. Go to Enterprise apps and clear the existing filter by clicking the X.

1. Search for Partner Center Web App.

1. Click Properties and Delete.

Warning: If you do not remove GoDaddy as a delegated admin before you cancel with them, they may run a script that deletes all users and removes the primary domain. Remove their delegated admin roles and ensure their admin user in the tenant is deleted BEFORE cancelling the subscription. The action is recoverable, but it causes extra work and downtime. For maximum safety, consider a solution that migrates to a new tenant in addition to defederation.

Cancel in GoDaddy#

In GoDaddy, cancel the renewal under My Account | Billing (opens in new tab):

The GoDaddy subscription expires at the end of term, and that is all. You now have a tenant under CSP with the full management functionality you are used to.

A few questions that come up#

Can I rename my SharePoint URL afterward? Yes. SharePoint URLs can be renamed per Microsoft's guide (opens in new tab). Update the default URLs to reflect the tenant domain:

Do I lose email or Teams data? No. There is no data loss.

What about archiving and backup? Email add-ons such as archiving and backup are lost in the transition, with one exception: GoDaddy supports moving Barracuda archives directly to Barracuda.

Does this break re-federating to another IdP like Okta? This is a common point of confusion. In testing, re-federating the account to Okta and signing in through them worked fine.