How to take over an unmanaged directory as administrator in Microsoft Entra ID (previously Azure Active Directory)

There are two ways to take over a DNS domain name in an unmanaged directory in Microsoft Entra ID. A self-service user, upon signing up for a cloud service that uses Microsoft Entra ID, is automatically added to an unmanaged Microsoft Entra directory corresponding to their email domain. The two ways to perform this action are:

• Internal admin takeover: You are added as the global administrator of the unmanaged directory, and no users, domains, or service plans are migrated to any other directory under your administration.
• External admin takeover: The DNS domain name associated with the unmanaged directory is added to your managed Azure directory. A user-to-resource mapping is established within your managed directory, ensuring uninterrupted access to services for users.

Internal admin takeover

Certain products like Microsoft 365, which encompass SharePoint and OneDrive, don't facilitate external takeovers. If you find yourself in such a situation, or if you're an admin seeking to take control of an unmanaged or "shadow" Microsoft Entra organization created by users who used self-service sign-up, you can achieve this through an internal admin takeover.

To perform an internal takeover, follow the below steps:

1. Create a user context in the unmanaged directory by signing up for Power BI. (The below steps are based on this assumption for convenience.)
2. In the Power BI site, select Start Free . Enter a user account that uses the domain name for the organization. Once you enter the verification code, check your email for the confirmation email.
3. Select Yes, that's me in the confirmation email from Power BI.
4. Sign into the Microsoft 365 admin center with the Power BI user account.
5. You will receive a message that instructs you to Become the Admin of the domain name that was already verified in the unmanaged directory. Select Yes, I want to be the admin .
6. Add the TXT record to prove that you own the domain name at your domain name registrar.
7. Once these are verified, you can manage the Microsoft Entra organization.

Now, you are the global administrator of the organization in Microsoft 365. Remove it from Microsoft 365 and add it to a different managed organization to integrate the domain name with your other Azure services.

To add the domain name to a managed organization in Microsoft Entra ID,

• In the Microsoft 365 admin center, select the Users tab and create a new user account without the custom domain name. For example, you can use the .onmicrosoft.com domain.
• Ensure that this user account has Global Administrator privileges for the Microsoft Entra organization.
• Go to the Domains tab and select the domain name and select Remove .
• If you have any users or groups that reference the removed domain, they must be renamed to the .onmicrosoft.com domain. Force deleting the domain name automatically renames all users.
• Now, sign into Microsoft Entra admin center as at least a Global Administrator.
• Search for Domain Names in the search box. Click Add custom domain names and add the domain name. You also have to enter the DNS TXT records to verify the ownership of the domain name.

External admin takeover

If you manage an organization with Azure services or Microsoft 365, you can't add a custom domain if it's verified in another Microsoft Entra organization. However, you can take over an unmanaged organization as an external admin takeover through your managed Microsoft Entra ID.

Verifying domain ownership with Microsoft Entra ID transfers the domain from an unmanaged organization to your existing one. External admin takeover follows the DNS TXT validation process like internal admin takeover, but also moves users, subscriptions, and license assignments along with the domain.

External admin takeover is supported by Azure Rights Management and Exchange Online online services. The supported service plans include:

• Power Apps Free
• Power Automate Free
• RMS for individuals
• Microsoft Stream
• Dynamics 365 free trial

It is not supported for any service that has service plans that include SharePoint, OneDrive, or Skype for Business.

Azure AD PowerShell cmdlets for ForceTakeover option:

About M365 Manager Plus

ManageEngine M365 Manager Plus is a Microsoft 365 reporting, auditing, management and monitoring tool. With M365 Manager Plus, you can:

• Assign tasks to technicians without requiring elevated native privileges.
• Gain better understanding of your Microsoft 365 services with pre-configured reports that can be easily scheduled, exported, and emailed.
• Track all user and admin activities within your Microsoft 365 organization with detailed audit reports.
• Bulk manage tasks such as user creation, deletion, and password resets, and automate them easily.
• Constantly monitor your organization's health and performance.
• Reduce the administrator's workload by delegating custom roles to help desk technicians.