Remove Microsoft 365 Domain Without Losing Access

This guide shows you how to remove a custom domain from your Microsoft 365 (formerly Office 365) tenant while keeping your admin account and all other services working. You’ll learn the correct order of operations, what to do with user email addresses, and how to avoid the common pitfall of locking yourself out.

What You’ll Need

Global administrator access to the Microsoft 365 admin center (admin.microsoft.com).
Access to the DNS hosting provider for the domain you’re removing (e.g., GoDaddy, Cloudflare, Namecheap).
A backup of any important emails or files stored in Exchange Online or SharePoint if you plan to delete users.
A secondary domain (like the default onmicrosoft.com domain) that can temporarily hold user email addresses.

Step-by-Step

Sign in to the Microsoft 365 admin center at admin.microsoft.com using an account that has Global Administrator privileges. If you only have User Administrator, you won’t be able to remove domains.
Identify all users and groups using the domain. Go to Users > Active users and check the email addresses. Also check Groups > Groups for distribution lists or Microsoft 365 groups that use the domain in their email address.
Change user email addresses to the default domain. For each user with the domain you’re removing, click the user, select Manage username and email, and change the primary email address to the onmicrosoft.com domain (e.g., user@yourtenant.onmicrosoft.com). You may also need to add an email alias with the default domain if the user has multiple addresses.
Update group email addresses. For each group that uses the domain, edit its email address to use the default domain. This includes Microsoft 365 groups, distribution lists, and mail-enabled security groups.
Check and remove the domain from all other services. Go to Settings > Domains, click on the domain you want to remove, and look for any warnings about “domain in use.” The admin center will list all services that still reference the domain (e.g., Exchange, SharePoint, Teams). Click each service and follow the prompts to remove the domain from that service.
Remove the domain from the admin center. Once the status shows “Domain is ready for removal,” click Remove domain. Confirm the removal when prompted.
Update DNS records (optional but recommended). After removal, you may want to delete the Microsoft 365 DNS records from your DNS provider to avoid confusion, especially if you’re moving the domain to another provider. If you’re just removing it from Microsoft 365, you can leave the records, but they’ll point to services that no longer exist.

Common Mistakes

Removing the domain while users still have it as their primary email. This will cause those users to lose email access and may break login if they use the domain for their UPN (user principal name).
Not updating the user principal name (UPN). Even if you change the email address, the UPN (the login name) might still be user@yourdomain.com. You must change the UPN to the default domain as well, or the domain removal will fail.
Forgetting about resource mailboxes. Shared mailboxes, room mailboxes, and equipment mailboxes also have email addresses. Check Exchange admin center > Recipients > Resources and update those too.
Ignoring the “domain in use” warnings. The admin center will not let you remove a domain until every dependency is cleared. Skipping steps will just lead to an error.
Deleting users before changing their email. If you delete a user, their mailbox is gone, and you may lose data. Always change the email first, then delete if needed.

Tips

Use the default onmicrosoft.com domain as a temporary home. It’s always available and cannot be removed, so it’s the safest place to move email addresses.
Do this during off-peak hours. Changing email addresses and UPNs can cause a brief interruption for users (usually a few minutes). Plan accordingly.
Create a CSV list of all changes. Before you start, export your users and note the current email and UPN. This helps you revert if something goes wrong.
If you’re moving the domain to another provider, export your DNS records first. You’ll need them to recreate the records at the new provider.
Consider using PowerShell. For large tenants, the admin center can be slow. The Set-MsolUserPrincipalName and Set-Mailbox cmdlets can batch-update users faster.

Troubleshooting

“Domain is in use” error persists after updating all users. Check for hidden dependencies: Azure AD applications, service principals, or even a user’s proxyAddresses attribute that still contains the domain. Use the admin center’s “Check health” button on the domain page to see the exact list of objects using the domain. If you find a user that you already updated, try removing the domain from the user’s alias list as well.

You can’t sign in after changing your own UPN. If you changed your own admin account’s UPN to the default domain, you’ll need to sign out and sign back in with the new UPN. If you get locked out, use the “Forgot password” flow or ask another admin to reset your password.

Email stops flowing after removal. If you removed the domain but still have mailboxes that point to it (e.g., you forgot a shared mailbox), those mailboxes will not receive email. Re-add the domain temporarily, fix the mailbox, and then remove again.

DNS records still point to Microsoft 365. If you’ve removed the domain but your DNS still has MX records pointing to Microsoft 365, email will be sent to Microsoft 365 but there’s no mailbox to receive it. Update your MX records to the new provider or remove them if you’re not using email.

You removed the domain but users can’t log in. This usually happens if the UPN still contains the removed domain. The UPN must be changed before removal. If it’s too late, re-add the domain, change the UPNs, then remove again.

Frequently Asked Questions

Can I remove the default onmicrosoft.com domain? No, the default domain (e.g., yourtenant.onmicrosoft.com) is permanent and cannot be removed. It’s always available as a fallback.

Will removing a domain delete my users? No, removing a domain does not delete users. It only removes the domain from the tenant. Users remain, but their email addresses and UPNs must be changed to a different domain first.

What happens to email sent to the removed domain after removal? Email sent to the removed domain will bounce back to the sender because the domain no longer resolves to Microsoft 365 (or if DNS still points to Microsoft 365, it will be queued and eventually fail).

Can I remove a domain if I’m not a global admin? No, only Global Administrators have permission to remove domains. If you don’t have the role, ask your admin to do it or grant you the role temporarily.

How long does it take for the domain removal to complete? The removal itself is usually instant, but DNS changes (if you update them) can take up to 48 hours to propagate worldwide.

Is it possible to remove a domain that is used for single sign-on (SSO)? Yes, but you must first disable SSO for that domain in the Azure AD admin center, and then ensure no users are using it as their UPN suffix. After that, you can remove it like any other domain.

General steps for current mainstream versions; menus can differ by device and version. See the disclaimer or report an error.

More in this bed

The whole Tech How-To bed →