Remove a domain from Microsoft 365

What you need before step 1

Applies to: Microsoft 365 and Microsoft Entra ID custom domains, as documented by Microsoft

9 steps

1. 1

   Sign in with an account on another domain

   Where: Microsoft 365 admin center, in a private browser window

   Sign in as an admin whose user name is on the .onmicrosoft.com domain or another custom domain, for example admin@contoso.onmicrosoft.com. Microsoft says you cannot delete a domain referenced in your own account name. If you are the only Global Administrator on the domain, create another Global Administrator on a different domain first.

   You should see: You are signed in as an admin not on the domain you are removing.
2. 2

   Change the default domain if needed

   Where: Microsoft 365 admin center > Settings > Domains, or Microsoft Graph PowerShell

   The domain being removed cannot be the default. Select another domain and set it as default, or use PowerShell.

   Connect-MgGraph -Scopes "Domain.ReadWrite.All","User.ReadWrite.All","Group.Read.All","Application.Read.All"
   Update-MgDomain -DomainId fabrikam.com -IsDefault

   You should see: The Domains page shows another domain marked Default.
3. 3

   List every object that still references the domain

   Where: PowerShell on your admin computer, connected with Connect-MgGraph

   Ask Graph which users, groups and other objects reference the domain, then find users by sign-in name, mail or proxy address, and apps whose identifier URIs use it.

   Get-MgDomainNameReference -DomainId contoso.com -All | Format-List Id,AdditionalProperties
   Get-MgUser -All -Property Id,UserPrincipalName,Mail,ProxyAddresses | Where-Object { $_.UserPrincipalName -like "*@contoso.com" -or ($_.ProxyAddresses -match "@contoso.com") } | Select-Object UserPrincipalName,Mail
   Get-MgApplication -All | Where-Object { $_.IdentifierUris -match "contoso.com" } | Select-Object DisplayName,IdentifierUris

   You should see: A list of the users, groups and apps you must change. The goal is for all three commands to return nothing.
4. 4

   List every mail recipient that uses the domain

   Where: PowerShell connected with Connect-ExchangeOnline

   This catches mailboxes, shared and resource mailboxes, contacts, distribution lists, mail-enabled security groups and Microsoft 365 groups with an address on the domain.

   Get-Recipient -ResultSize Unlimited | Where-Object {$_.EmailAddresses -match "contoso.com"} | Format-List Name,RecipientType,EmailAddresses

   You should see: Each recipient still using the domain, with its RecipientType.
5. 5

   Move user sign-in names to another domain

   Where: PowerShell connected with Connect-MgGraph (cloud-only users), or on-premises Active Directory (synchronised users)

   For hundreds of users, Microsoft recommends PowerShell so none are missed. For synchronised users, change the UPN in on-premises Active Directory and let sync update Microsoft 365.

   Update-MgUser -UserId annb@contoso.com -UserPrincipalName annb@fabrikam.com

   You should see: The user now signs in as annb@fabrikam.com.
6. 6

   Remove the domain from email addresses

   Where: PowerShell connected with Connect-ExchangeOnline

   Use the EmailAddresses parameter on the cmdlet that matches each RecipientType: Set-Mailbox for mailboxes, Set-DistributionGroup for distribution and mail-enabled security groups, Set-DynamicDistributionGroup for dynamic groups, and Set-UnifiedGroup for Microsoft 365 groups. An address that starts with uppercase SMTP: is the primary; move the primary to another domain before removing the old one.

   Set-Mailbox -Identity annb@fabrikam.com -EmailAddresses @{add="SMTP:annb@fabrikam.com"}
   Set-Mailbox -Identity annb@fabrikam.com -EmailAddresses @{remove="smtp:annb@contoso.com"}
   Set-DistributionGroup -Identity sales@contoso.com -EmailAddresses @{remove="smtp:sales@contoso.com"}
   Set-UnifiedGroup -Identity marketing -EmailAddresses @{remove="smtp:marketing@contoso.com"}

   You should see: Rerunning the Get-Recipient command from step 4 returns nothing.
7. 7

   Fix apps that use the domain

   Where: Microsoft Entra admin center > App registrations > the app > Expose an API, or Microsoft Graph PowerShell

   Change or remove any application ID URI that contains the domain. Microsoft says a domain cannot be deleted while any application has an app ID URI that includes it.

   You should see: The Get-MgApplication command from step 3 returns nothing.
8. 8

   Remove the domain

   Where: Microsoft 365 admin center > Settings > Domains

   Select the domain, then Remove domain in the properties pane, then Remove domain again in the Remove domain? pane. Or run the PowerShell command.

   Remove-MgDomain -DomainId contoso.com

   You should see: The domain disappears from the Domains list. Microsoft says this can take five minutes when few objects referenced it, or several hours up to a day when many did.
9. 9

   Use ForceDelete only if you accept renaming

   Where: Microsoft Entra admin center (Azure portal) > Custom domain names, or Microsoft Graph

   ForceDelete renames remaining user UPNs, email and proxy addresses, group email addresses and app identifier URIs to the onmicrosoft.com domain, and disables the renamed user accounts (optional in Graph). It needs fewer than 1,000 references, no multitenant apps, Exchange-mastered groups cleaned up first, and does not work for federated domains, domains bought through Microsoft 365, or partners acting for a customer.

   POST https://graph.microsoft.com/v1.0/domains/contoso.com/forceDelete
   { "disableUserAccounts": true }

   You should see: The operation runs in the background. Afterwards a get domain request for contoso.com returns HTTP 404.

Expert tips

How to confirm it worked

• The domain no longer appears on Settings > Domains.

• Get-MgDomain -DomainId contoso.com returns a not found error.

• The other tenant or service can now add and verify the domain.

How to reverse it

Errors you might see

Questions

Official sources

Vendors change menus and requirements. Confirm on the source before you rely on a detail. Last checked 4 Nov 2026.