How to move your Microsoft 365 email out of GoDaddy

If you bought Microsoft 365 through GoDaddy and later tried to do something slightly unusual — connect a line-of-business app, change your own licences, or open the real Microsoft admin centre — you'll have discovered that your Microsoft 365 isn't quite the Microsoft 365 everyone else has. This guide explains why that is, what the exit process (“defederation”) involves, and how to get through it without losing mail or a day's work. It's written for non-technical business owners; where there's unavoidable jargon, we translate it.

What “federated” actually means

When you buy Microsoft 365 directly from Microsoft, or through a conventional reseller, a tenancy is created for your business — your own private slice of Microsoft's cloud, registered to your company, with your domain attached and an administrator account you control.

GoDaddy's Microsoft 365 works differently. Your user accounts are created inside an arrangement that is federated with GoDaddy's systems: sign-in is routed through GoDaddy's identity service, management happens in GoDaddy's own simplified dashboard, and the commercial relationship with Microsoft belongs to GoDaddy rather than to you. You're not renting your own flat; you have a room in theirs. For basic email that distinction can go unnoticed for years. It surfaces the moment you need anything the dashboard doesn't offer.

Why your admin centre is restricted

The full Microsoft 365 admin centre assumes whoever opens it has Global Admin rights over the tenancy. Under GoDaddy's model, GoDaddy holds that position — that's the point of the federation. What you get instead is GoDaddy's portal, which exposes the common tasks (add a user, reset a password) and little else. In practice, the things small businesses eventually bump into include:

• No direct access to Exchange settings — transport rules, connectors, shared mailbox quirks;
• Licence choices limited to the bundles GoDaddy sells, at GoDaddy's pricing;
• Security tooling (conditional access, audit logs, Defender policies) out of reach;
• Third-party apps that ask you to “grant admin consent” and then can't.

None of this is a fault, exactly — it's the product working as designed. The design just stops fitting once a business wants to own its own infrastructure.

What defederation is

Defederation is GoDaddy's formal process for releasing your accounts from their federation so the tenancy becomes independently yours. After it completes, sign-in stops routing through GoDaddy, their dashboard stops managing your users, and you (or a partner you choose) take over the Global Admin role and the licence billing. Your mailboxes, OneDrive files and Teams data stay where they are — what changes is who holds the keys.

That last sentence is the reassuring part. The unnerving part is the transition itself: it's abrupt, it touches every user at once, and there are two or three places where a misstep genuinely hurts. Hence the rest of this guide.

The process, step by step

1. Audit what you actually have

List every user, shared mailbox, alias and distribution group, and note which licences each person holds. Check where your domain's DNS is hosted (often also GoDaddy) and screenshot the current mail-related records. Ten minutes here saves hours later.

2. Take a real backup first

Before anything changes hands, back up every mailbox — either a full export from Outlook per user or, better, a third-party Microsoft 365 backup that also captures OneDrive. Defederation done correctly doesn't delete data, but “done correctly” is exactly what you can't guarantee in advance. Backups convert a catastrophe into an inconvenience.

3. Arrange replacement licences before you start

The moment federation ends, GoDaddy's licences begin to lapse. You need equivalent Microsoft licences ready to assign — bought directly from Microsoft or through a Cloud Solution Provider — so mailboxes never sit unlicensed. Match like for like first; you can change tiers later.

4. Request defederation from GoDaddy

This is a support request to GoDaddy, and at the time of writing it can't be self-served. Expect identity checks and a short scheduling window. Ask them to confirm in writing when it will run.

5. Seize the admin account immediately

When federation drops, every user's password is reset and a new local admin credential comes into play. Sign in to the real Microsoft admin centre straight away, secure the Global Admin account with a strong password and multi-factor authentication, and assign your new licences before the old ones expire.

6. Re-point DNS and verify mail flow

If your DNS stays at GoDaddy that's fine — domains don't have to move — but the mail records (MX, SPF, DKIM CNAMEs, DMARC) must be checked and usually re-verified in the new admin centre. Send test mail in both directions, from inside and outside the organisation, before declaring victory.

7. Walk the users through reconnecting

Everyone gets a new password on the same morning, and Outlook and phones will prompt for it. A one-page “here's what to expect” note sent the day before turns a support storm into a non-event.

How long does all this take?

The defederation itself is quick — typically minutes once GoDaddy runs it. The elapsed time is in the preparation and the queue: allow a few days for GoDaddy's scheduling, an evening for the switchover and checks, and a quiet morning after for stragglers whose phones haven't asked for the new password yet. For a business of under twenty mailboxes, the whole project comfortably fits inside a week without anyone working a weekend.

The risks of doing it yourself

People do DIY this successfully. The failures we get called about cluster in the same few places:

• Licence gaps. Defederating before replacement licences exist leaves mailboxes unlicensed; leave them that way long enough and Microsoft's retention clock starts running.
• The password stampede. Every user reset at once, mid-week, with no warning and nobody holding a list of who's reconnected.
• DNS drift. Mail records copied by eye, a missing DKIM selector, and a week of intermittent “your message couldn't be delivered” that gets blamed on everything except the real cause.
• No backup. Almost always fine. Occasionally unrecoverable.

What a clean handover looks like

Done properly, the whole thing is an evening's work with a quiet morning after: backup verified before the request goes in; licences purchased and waiting; the defederation scheduled out of hours; admin secured within minutes; DNS checked against the audit from step one; test mail confirmed both ways; and every user holding a short note that says exactly what to type when Outlook asks. Your team notices a password prompt and nothing else — and from that day the tenancy, the domain and the Microsoft relationship are registered to your business, which is how it should have been all along.