Microsoft Data Protection team Domain tenant release request

Open a Microsoft support request from your current tenant and ask for the Data Protection Team to verify ownership and release the domain from the inaccessible old tenant.

Microsoft Entra permits a custom domain to be verified in only one tenant at a time, so the DNS record proves ownership but does not detach the domain from an existing managed tenant.^1^

Submit the release request

Use either portal:

• Microsoft Entra admin center → Help + Support → New support request
  • Issue type: Technical
  • Service: Microsoft Entra ID
• Or Microsoft 365 admin center → Help & support → Contact support

Use wording such as:

I own and control the DNS for <domain>, but it is verified in an old Microsoft Entra tenant that I cannot access. The required DNS verification record has already been added. Please route this case to the Microsoft Data Protection Team to validate ownership and release the domain so it can be verified in my current tenant.

Include:

• Domain name
• Current tenant ID
• Old tenant ID, if known
• Error text and correlation/request ID from the failed verification
• Evidence of DNS management access
• Relevant subscription or billing history
• Business registration or authorized-signatory documentation, if requested

Matching cases were resolved after a support ticket was routed to Data Protection and domain ownership was validated.^2^^3^

If portal support is unavailable, use Microsoft’s business-support contact options and request creation of a service request for the Data Protection Team.^4^

After Microsoft confirms release, return to Microsoft Entra admin center → Entra ID → Domain names, select the domain, and choose Verify.

If the old tenant is accessible

Sign in with an account using the old tenant’s .onmicrosoft.com domain and at least the Domain Name Administrator role. Remove every user, group, email/proxy address, and application identifier that references the custom domain, then delete it under:

Entra ID → Domain names → Custom domain names → domain → Delete

Warning: Removing or force-deleting an active domain can disrupt user sign-in, email addresses, groups, and applications. ForceDelete can rename identities and disable affected accounts, so assess production impact before using it.^5^

If the old tenant is unmanaged

Only use this branch after establishing that the old directory is an unmanaged or shadow tenant created through self-service signup. A managed tenant must use the support route above.

External takeover requires Domain.ReadWrite.All; the signed-in administrator must hold a supported role, with Domain Name Administrator being the least privileged. Add the domain, obtain the TXT challenge, publish it, and call Microsoft Graph with forceTakeover=true:^6^

Install-Module Microsoft.Graph
Connect-MgGraph -Scopes "Domain.ReadWrite.All"

$domain = "contoso.com"
New-MgDomain -BodyParameter @{ Id=$domain; IsDefault=$false }

Get-MgDomainVerificationDnsRecord -DomainId $domain |
  Where-Object RecordType -eq "Txt"

After adding the returned TXT value to authoritative DNS:

$body = @{ forceTakeover = $true } | ConvertTo-Json

Invoke-MgGraphRequest -Method POST `
  -Uri "https://graph.microsoft.com/v1.0/domains/$domain/verify" `
  -Body $body `
  -ContentType "application/json"

External takeover is not supported for unmanaged directories containing service plans that include SharePoint, OneDrive, or Skype for Business, or across cloud boundaries. In those cases, use the applicable internal-takeover or Microsoft Support path instead.^6^

References

1. Add your custom domain name to your tenant
2. I need Microsoft to release my domain from old broken tenant to my new business tenant - Microsoft Q&A
3. Custom domain is already verified by another account - Microsoft Q&A
4. Contact Microsoft customer support
5. Manage custom domain names in your Microsoft Entra ID
6. Take over an unmanaged directory as administrator in Microsoft Entra ID