How do you move a custom domain from one Microsoft 365 tenant to another?

Why the domain has to move at cutover

• A domain name can be verified in only one Microsoft Entra tenant. To verify it in the destination, you first remove it from the source.
• One exception: a subdomain, such as europe.contoso.com, can be verified in a different tenant from contoso.com with its own DNS record.
• Until the domain moves, people in the destination tenant use their onmicrosoft.com addresses, and Microsoft recommends mapping mailboxes between the tenants by those addresses.

A few days before cutover

• Add the domain in the destination tenant and create its verification TXT record. Verification fails while the source still has the domain, but the record has time to spread; Microsoft says DNS changes can take up to 72 hours.
• Lower the MX record’s TTL, to about five minutes if your DNS host allows it, so the cutover change takes effect quickly.
• If the source tenant syncs from on-premises Active Directory, turn off directory synchronization there. Microsoft says this can take 24 hours or more.

What has to come off the source tenant

• If the domain hosts a SharePoint public website, set the site’s URL back to the initial onmicrosoft.com domain.
• It cannot be the default domain: make the onmicrosoft.com domain the default.
• No user sign-in names or email addresses, including secondary proxy addresses, can use it.
• No shared or resource mailboxes, contacts, Microsoft 365 groups, distribution lists, or teams can use it. Mail-enabled security groups and distribution lists are cleaned up in the Exchange admin center.
• No app ID URIs can use it.
• The admin removing it cannot be signed in with an account on that domain.
• If the domain is federated, for example with AD FS, rename or remove its users and groups in on-premises Active Directory first; the forced delete option does not work for federated domains.

With hundreds or thousands of users, Microsoft recommends PowerShell, because one missed user blocks the removal.

The cutover order Microsoft gives

1. Hold inbound mail: point the MX record at a host that does not accept mail, so sending servers queue messages and retry for up to 24 hours. Some may return a non-delivery report instead; a backup MX service can hold mail for longer.
2. Remove the domain from every object in the source tenant, then remove the domain itself.
3. Verify the domain in the destination. You may have to wait an hour after removing it from the source.
4. Optionally add the autodiscover CNAME record, and if you use AD FS, configure the domain for AD FS in the destination.
5. Assign licenses to the destination users, then make the domain their primary email address.
6. If you do not use password hash sync, pass-through authentication, or AD FS, set passwords on the destination accounts and tell people.
7. Once the mailboxes are licensed and active, point the MX record at the destination. When the old TTL expires, mail flows into the new mailboxes; release anything a backup MX service held.
8. Test mail flow in both directions, then re-create mail flow rules, connectors, and allow and block lists from the source.

The MX record moves last so that mail arrives only after a licensed mailbox holds each address. In Microsoft’s third-party-tool scenario, mailbox content is copied after this: people start in new, empty mailboxes, and older mail fills in over one or more passes.

How long each step can take

Planning it with Accred

Accred Migrate plans tenant-to-tenant moves by client, wave, and workload and is in early access. The domain move itself is done in the Microsoft 365 admin center, the Microsoft Entra admin center, and DNS. For a walk-through of keeping mail flowing during the move, see Accred Consulting’s guide to moving an email domain without losing mail. To have the whole move run for you, see Accred Consulting’s tenant-to-tenant migration service.

Questions

Sources

1. How to migrate mailboxes from one Microsoft 365 organization to another · Microsoft Learn
2. Remove a domain from Microsoft 365 · Microsoft Learn
3. Add and verify custom domain names in Microsoft Entra ID · Microsoft Learn
4. Add your custom domain to Microsoft Entra · Microsoft Learn
5. Cross-tenant mailbox migration · Microsoft Learn