Azure AD tenant completely locked out - federated domain moved from GoDaddy to NameCheap, federation broken

Allan Watkins 0 Reputation points
2026-05-28T21:39:30.49+00:00

My Azure AD tenant (tenant ID: bf04ef93-ce73-46c1-b72b-72830d9efa52, subscription ID: f1100c68-bef9-4ff5-8e70-3ed1d67c9628) is completely inaccessible. The domain lawsofrobots.net was previously federated to GoDaddy as the identity provider. The domain has since moved to NameCheap for both DNS and email hosting. The GoDaddy federation is now broken - every login attempt to ******@lawsofrobots.net redirects to GoDaddy SSO which no longer works. I can receive email at ******@lawsofrobots.net via NameCheap and I can add DNS TXT records to lawsofrobots.net via NameCheap to prove domain ownership. I need the federation removed or reset so I can log in directly. No other admin accounts exist with working access.

Microsoft Security | Active Directory Federation Services
0 comments

1 answer

Sort by: Most helpful
Most helpful Newest Oldest
  1. Danjuma Ibrahim 0 Reputation points
    2026-05-28T21:49:44.74+00:00

    Hi there,

    This is a classic and notoriously frustrating identity lockout scenario. GoDaddy uses a custom Active Directory federation model, and when you migrate your DNS and email to another provider like NameCheap without first defederating the domain inside Azure AD, the tenant remains hardcoded to redirect all authentication attempts back to GoDaddy's defunct SSO infrastructure.

    Since you are in a "Zero Admin" state with the custom domain, here is exactly how you can regain access:

    1. Check for the "Break-Glass" Account When the Azure AD tenant was first provisioned, Microsoft created a default routing domain. If you (or the previous admin) have the password for the original [admin]@lawsofrobots.onmicrosoft.com Global Administrator account, try logging in with that at portal.azure.com. Accounts ending in .onmicrosoft.com bypass custom domain federation entirely. Once in, you can use the MSOnline or Graph PowerShell modules to force the defederation.

    2. Escalate to the Microsoft Data Protection Team If no .onmicrosoft.com fallback exists, standard tier-1 support cannot help you. You must engage the Data Protection Team, as only Microsoft can forcefully defederate the domain from the backend.

    Call the Microsoft Azure / Microsoft 365 Business Support phone number for your region.

    Clearly state that you are experiencing a "Tenant Lockout due to broken GoDaddy Federation" and need to escalate to the Data Protection Team.

    They will ask for the Tenant ID and Subscription ID you provided. To prove ownership, they will give you a unique string to add as a DNS TXT record. Since you have access to NameCheap, you will pass this verification step easily and they will help you reset the admin access.

    Hang in there—it takes a little time on the phone with Microsoft, but since you control the DNS, you will definitely get your tenant back!

    Was this answer helpful?

Your answer

Answers can be marked as 'Accepted' by the question author and 'Recommended' by moderators, which helps users know the answer solved the author's problem.