SUMMARY AND BACKGROUND

Customers can purchase a Microsoft 365 subscription direct with GoDaddy along with their primary domain. When this occurs, GoDaddy federates this domain and tenant, making it unable to transfer under the CSP program or Direct to Microsoft. Moving and defederating this account has been a major pain point and area of confusion which this article addresses.

In the solutions proposed in this guide you can perform the following:

  • Defederate the tenant without migrating
  • Never have to call GoDaddy
  • Keep user accounts vs deleting them
  • Have no downtime

High-level steps:

  1. Prepare your End Users
  2. Become a Tenant Admin in GoDaddy
  3. Remove Federation with GoDaddy
  4. Reset Users Passwords
  5. Add Manage Protect as a CSP Provider
  6. Provision Licensing into the Account
  7. Remove GoDaddy as Delegated Admin and Remove Enterprise App
  8. Cancel GoDaddy Subscription


A. Prepare Your End Users

  • Defederating requires users to reset their passwords in order to be able to log in to their account. You will need a password list to distribute to them, or have them provide you passwords beforehand. You could also reset them all to a temporary password after defederation and they can change it afterwards — there is a script later in this article.
  • Define a date and time at which you will be defederating. Non-business hours are recommended even though there is no downtime in mail flow with this solution. Provide end users with this information.
  • Since users may run into activation prompts within their Office apps and Outlook during the licence transition, provide them documentation for how to sign back in after the licence switch has taken place. For Office apps they can simply go to File > Account > Sign Out > Sign In.
  • In Outlook, users will be prompted to re-enter their new password after it is changed:

Outlook password prompt



B. Become a Tenant Admin in GoDaddy

When a user sets up a 365 account directly with GoDaddy, the initial user is set up as an "admin", but this user is redirected to the GoDaddy portal when trying to access the admin tab from Office.com. For this reason, we need to gain access to the true Global Admin so that we can run the necessary PowerShell scripts to defederate the tenant.

  1. Log in to portal.azure.com with the admin user that was set up when the account was first created and click on the 3 lines in the top left corner.
  2. Click on Azure Active Directory, then click on Users when the new tabs open up.
  3. Here you should see a user labelled admin@<randomname>.onmicrosoft.com. Ex:

onmicrosoft.com admin user

Click on this user and reset their password. If you already have access to this user, you can disregard this step.

Once you have copied the temporary password, place it in a notepad and open an incognito window in the browser. Go to office.com and sign in with that username and temporary password, then establish a new password. With this completed, you now have a user that can run the necessary PowerShell commands in the future steps.


C. Remove Federation with GoDaddy

Be Aware: Before you perform this step, make sure all users have the passwords you will be resetting, as they will not be able to log in without that new password.

We can use the following PowerShell cmdlets to defederate the tenant. Note that you need to run PowerShell as administrator.


Write-Host "Checking for MSGraph module..."
$Module = Get-Module -Name "Microsoft.Graph.Identity.DirectoryManagement" -ListAvailable

if ($Module -eq $null) {
Write-Host "MSGraph module not found, installing MSGraph"
Install-Module -Name Microsoft.Graph.Identity.DirectoryManagement
}

Connect-MgGraph -Scopes "Directory.Read.All","Domain.Read.All","Domain.ReadWrite.All","Directory.AccessAsUser.All"
# Enter the Admin credentials from "Become a Tenant Admin in GoDaddy"

Get-MgDomain
# See that the domain is "Federated"

Update-MgDomain -DomainId "<InsertFederatedDomain>" -Authentication Managed

An example of a DomainId is "company23.com". This would be the domain listed as federated that you want to convert to managed. After this is complete you will get a new command line. You can run Get-MgDomain again and see that your domain is now "Managed".

Please Note: ALL domains in the tenant need to be in a managed state for this to work correctly, even if one is no longer in use.

Supporting cmdlet docs:

D. Reset Users Passwords

You can do this manually one user at a time if there aren't many users in the account, or you can use a PowerShell script to bulk update everyone's passwords from a CSV file. If you plan to do them manually, simply log in to office.com as the admin derived from section B — now that the tenant is defederated you will be able to click into the admin tile and access the Users section as normal. Otherwise, connect to PowerShell as administrator and run one of the scripts below.

Single User Update

# --- Load Graph modules ---
Import-Module Microsoft.Graph.Users -ErrorAction Stop
Import-Module Microsoft.Graph.Authentication -ErrorAction Stop

# --- Connect to Graph ---
Write-Host "Connecting to Microsoft Graph..." -ForegroundColor Cyan
Connect-MgGraph -Scopes "User.ReadWrite.All"

$passwordProfile = @{
Password = '<InsertPassword>'
ForceChangePasswordNextSignIn = $true # optional
}

Update-MgUser -UserId 'example@domain.com' -PasswordProfile $passwordProfile


Multi-User Update

CSV format — make a CSV like this:

UserPrincipalName,NewPassword
alice@contoso.com,P@ssw0rd123!
bob@contoso.com,Secur3Pwd!
charlie@contoso.com,Hada9200!
  • UserPrincipalName – UPN / sign-in name of the user
  • NewPassword – the new password you want to assign


Script

<#
.SYNOPSIS
Bulk reset user passwords in Entra ID using Microsoft Graph.
.DESCRIPTION
Imports a CSV of users and sets each account's passwordProfile.Password.
Requires: Microsoft.Graph module and User.ReadWrite.All (or Directory.AccessAsUser.All).
.PARAMETER CsvPath
Path to the CSV file containing UserPrincipalName and NewPassword columns.
#>
param(
[Parameter(Mandatory = $true)]
[string]$CsvPath
)

# --- Load Graph modules ---
Import-Module Microsoft.Graph.Users -ErrorAction Stop
Import-Module Microsoft.Graph.Authentication -ErrorAction Stop

# --- Connect to Graph ---
Write-Host "Connecting to Microsoft Graph..." -ForegroundColor Cyan
Connect-MgGraph -Scopes "User.ReadWrite.All"

# --- Import CSV ---
if (-not (Test-Path $CsvPath)) {
throw "CSV file not found at path: $CsvPath"
}

$users = Import-Csv -Path $CsvPath

if (-not $users) {
throw "CSV file '$CsvPath' contains no rows."
}

Write-Host "Processing $($users.Count) users from CSV..." -ForegroundColor Cyan

$results = @()

foreach ($user in $users) {
$upn = $user.UserPrincipalName
$newPassword = $user.NewPassword

if ([string]::IsNullOrWhiteSpace($upn) -or [string]::IsNullOrWhiteSpace($newPassword)) {
Write-Warning "Skipping row with missing UserPrincipalName or NewPassword."
continue
}

$passwordProfile = @{
Password = $newPassword
ForceChangePasswordNextSignIn = $true # set to $false if you don't want this
}

try {
Write-Host "Updating password for $upn ..." -ForegroundColor Yellow
Update-MgUser -UserId $upn -PasswordProfile $passwordProfile
$results += [pscustomobject]@{ UserPrincipalName = $upn; Status = "Success"; Error = $null }
}
catch {
Write-Warning "Failed to update password for $upn : $($_.Exception.Message)"
$results += [pscustomobject]@{ UserPrincipalName = $upn; Status = "Failed"; Error = $_.Exception.Message }
}
}

# --- Output summary ---
Write-Host ""
Write-Host "Bulk password reset completed." -ForegroundColor Green
$results | Format-Table -AutoSize

# Optionally export results to CSV:
# $results | Export-Csv -Path ".\PasswordResetResults.csv" -NoTypeInformation


Leveraging the Admin Portal

If you do not want to use PowerShell, you can reset users' passwords one by one in the Entra Admin Center > Users > Select User > Reset Password.



E & F. Add Manage Protect as CSP Provider and Provision Licensing

Now that the tenant is defederated, you can add a Manage Protect as the CSP provider with our delegated admin link, Support will provide this to connect up the customer, please reach out to support@manageprotect.com to connect up your existing tenancy.

Be sure to check if your existing GoDaddy licensing includes email security. GoDaddy leverages Proofpoint for products bundled with Email Security. Additional configuration is required. See the Email Security section below.

For CSP:

Paste the appropriate link in a browser and sign into the tenant with the Global Admin credentials if you are not already logged in. Accept the reseller relationship from Manage Protect (Rhipe). After acceptance, reload the page and you will see a new CSP listed.


Order licensing for this customer. If you are not changing the subscription, all you need to do is provision the same number of seats as you have today, remove GoDaddy as delegated admin, and cancel with GoDaddy. Licence ownership will transfer and there will be no downtime for users.


If you are changing the subscriptions assigned to users (e.g. moving them from Business Standard to Business Premium), perform the following steps:

  1. Order the licensing from Manage Protect.
  2. See the licensing provisioned in the 365 tenant for this customer under Billing > Your Products.
  3. Go to Users > Active Users and bulk assign the new licensing  and unassign the licensing from GoDaddy.

Billing - Your Products

Assign licences



Email Security (i.e. Proofpoint Considerations)

If you have a plan with GoDaddy that includes email security, they layer in Proofpoint. Proofpoint redirects mail flow to their portal via the MX record. If you have this plan and do not change MX records after cancellation, EMAIL WILL GO DOWN. Note that if you do not have one of these plans you do NOT have to follow these steps.

Where to check:

  1. Go to My Account | Billing in GoDaddy.
  2. Look for a subscription that has email + security. Examples:

GoDaddy subscription example 1

GoDaddy subscription example 2

GoDaddy email and security plan



Updating your DNS records:

The Domain section of GoDaddy will host all of your DNS records. Ex:

GoDaddy DNS records


Here you will find the MX records for Proofpoint:

Proofpoint MX records

From here you have two options:

  1. Manually update the records in GoDaddy.
  2. Use the "Add DNS Records for me" functionality in the Microsoft Admin Portal.

In either case, head over to the admin portal for the tenant: https://admin.cloud.microsoft/#/Domains

From here you can find the MX record to update in GoDaddy. Ex:

Microsoft MX record

You can update the existing MX record in GoDaddy and delete the other two.



G. Remove GoDaddy as Delegated Admin

Warning! If you do not follow the steps to remove GoDaddy as a delegated admin before you cancel with them, they will run a script to delete all users in the account and remove the primary domain. Ensure you remove them as delegated admin after the move and that their admin user is deleted in the account BEFORE cancelling the subscription. This action is recoverable, but it causes more work and does involve downtime. If you want additional safeguards against this, consider a solution that migrates to a new tenant in addition to defederation.

In the 365 Admin Portal, go to Settings > Partner Relationships > click on GoDaddy > Roles > remove their roles:

Partner relationships

Remove roles

Remove Enterprise App (NEW as of Nov 2025)

GoDaddy also has an Enterprise app that they could leverage to perform write activity even after GDAP is removed. This is done from an Enterprise App called "Partner Center Web App". You need to delete this from the Enterprise apps section in Entra.

Go to https://entra.microsoft.com/ as an admin.

Go to Enterprise apps and click on the X on the existing filter for Enterprise Applications.

Enterprise apps filter



Search for Partner Center Web App.

Search Partner Center Web App


Click on Properties and Delete.

Delete Enterprise App



H. Cancel in GoDaddy

In GoDaddy, cancel the renewal: My Account | Billing

Cancel renewal in GoDaddy

Conclusion

From here, the subscription from GoDaddy will expire at end of term and that is all. You now have a tenant under CSP with all of the typical management functionality you are familiar with.