Moving Microsoft 365 off GoDaddy without losing email

Why is Microsoft 365 from GoDaddy hard to leave?

When you buy Microsoft 365 through GoDaddy, your mailboxes sit in a normal Microsoft 365 tenant. GoDaddy controls three things around them. Your domain’s sign-in is federated to GoDaddy, so staff type their password on a GoDaddy page and the password lives there. GoDaddy pays for the licenses. And GoDaddy holds admin roles in your tenant.

That is why “just cancel GoDaddy” is risky. If a mailbox loses its license, Microsoft holds the Exchange Online data for 30 days and then deletes it for good (Microsoft: assign or unassign licenses). The answer is not to migrate mail at all. You take over sign-in, billing and admin access, and the mailboxes stay exactly where they are.

What do you need before you start?

• A list of every user and shared mailbox, and which license each one has.
• A copy of every mailbox. Classic Outlook can export a mailbox to a .pst file. By default it only keeps the last year of mail on the computer, so set the sync slider to All first (Microsoft: export to a .pst file). We saved every message as a file and compared the count folder by folder.
• Access to your DNS records, wherever your domain’s DNS is managed.
• A company payment card for the direct Microsoft subscription.
• Time. We switched sign-in and bought the license in one working day, then swapped licenses and cleaned up over the next two.
• A heads-up to staff. Everyone will set a new password and sign in again in Outlook and on their phones.

In what order should you do the move?

This is the order we followed on our own tenant. Each step depends on the one before it.

1. Make the cloud-only admin account work first. In our tenant, GoDaddy had created a Global Administrator on the tenant’s .onmicrosoft.com address, and nobody knew its password. Check whether yours has one. While your normal sign-in still works, reset that account’s password in the Microsoft Entra admin center, sign in with it in a private browser window, set a new password and add multi-factor sign-in. Microsoft recommends cloud-only .onmicrosoft.com admin accounts for this reason: they don’t depend on a federated sign-in (Microsoft: emergency access accounts). Do not go further until this account signs in. After step 3, it is the only way to reset everyone else.
2. List every domain in the tenant. In Microsoft Graph PowerShell, Get-MgDomain shows each domain and whether it is Federated or Managed. Every federated domain needs converting in the same session.
3. Switch sign-in from GoDaddy to Microsoft. Signed in as the cloud admin, run Update-MgDomain with -AuthenticationType Managed for each federated domain (Microsoft: Update-MgDomain). Mail keeps flowing. Only sign-in changes.
4. Reset each user’s password as the cloud admin (Microsoft: reset passwords) and turn on multi-factor sign-in for every user. Our user was signed in with a new password a few minutes later.
5. Buy licenses directly from Microsoft. In the Microsoft 365 admin center, go to Billing and buy the plan your staff need. We accepted the Microsoft Customer Agreement and set up a billing profile in the same flow.
6. Swap licenses with no gap. On each user, we ticked the new license and unticked GoDaddy’s in the same save. Then send a test to an outside address, reply to it, and sign in again in Outlook and on phones.
7. Export the mailboxes again to pick up mail that arrived since your first copy. It is your last easy safety net.
8. Remove GoDaddy’s admin roles. In the admin center, go to Settings > Partner relationships, select GoDaddy and choose Remove roles (Microsoft: manage partner relationships). In our tenant GoDaddy held more than a dozen admin roles. A billing-only GoDaddy row stays until the GoDaddy subscription ends. That is expected, because removing roles does not end the relationship.
9. Delete the Partner Center Web App. In the Entra admin center, open Enterprise apps, clear the default filter, search for “Partner Center Web App,” then choose Properties > Delete (Microsoft: delete an enterprise application). Migration guides from other IT providers warn that GoDaddy’s cancellation can still reach the tenant through this app and remove users or the domain. Leave Microsoft’s own apps with similar names alone.
10. Change the cloud admin password again if it was ever typed on a GoDaddy page. Ours was, once (see below).
11. Cancel the GoDaddy email plan last. We turned off auto-renew and let the plan end with its term, rather than deleting anything right away. Keep the cloud admin account.
12. Clean up your DNS. Replace GoDaddy’s SPF include (ours was include:secureserver.net) with Microsoft’s include:spf.protection.outlook.com (Microsoft: set up SPF). Turn on DKIM for your own domain: publish the two selector CNAME records Microsoft gives you, then enable signing (Microsoft: set up DKIM). Send DMARC reports to an address you read instead of GoDaddy’s. Remove GoDaddy-only records, but keep records for other services that send mail as your domain, such as a website form service.

Finally, send a test to a Gmail address and open “Show original.” You want SPF, DKIM and DMARC to show pass for your own domain.

What surprised us during our own move?

• The admin center sent us to GoDaddy. While the domain was federated, admin.microsoft.com redirected every sign-in to GoDaddy’s page, so we could not buy the direct license first. After step 3 it opened normally. That is why buying comes after the switch in our order, and why we changed the admin password again afterward.
• Microsoft’s public sign-in lookup lagged. Right after the switch it still called the domain federated, just with no GoDaddy address. It caught up later. Test by actually signing in.
• Our mail was signed with the wrong name. Until we turned on DKIM, our test message was signed with the tenant’s .onmicrosoft.com name, not our domain. DMARC only counts a signature that matches your From domain.
• Password resets break saved app sign-ins. Any tool that reads mail on a user’s behalf has to sign in again and re-approve its access.
• Old records pile up. Our DNS still had Skype for Business records from years ago. We removed them during the clean-up.

Will staff notice, and how long does it take?

Mail never stopped during our move. Staff notice three things: a new password, a multi-factor sign-in prompt and one round of signing in again on each device. For a small office, plan the switch for a quiet afternoon and have someone free to help with phones.

If you would rather not do this yourself, our Microsoft 365 support team plans the order, runs the switch with you and writes down every change. If the GoDaddy account was set up by a former employee or vendor, or nobody is sure who the admins are, start with our cybersecurity services review so we can see who still has access.

Need help?

Call us at (330) 741-1331, email support@compitservice.com or use our contact page. Not sure who controls your Microsoft 365 today? Our free security assessment looks at your admin accounts, sign-in security and email records, and you get the findings in writing.