Adding a subdomain to custom domain in Entra ID

Question

we are looking into integrating office 365 with a 3rd party password less auth service.

part of the requirements are to change the domain authentication type to Federated. Since we do not want our tests to affect existing users, the solution is to work with an intermediary domain.

for testing convenience, and to prevent confusion for the end user, we prefer this intermediary domain to be as similar to the regular domain.

for example, current custom domain is "contoso.com", users log in using "*** Email address is removed for privacy ***".

intermediary domain should be something like "department.contoso.com" so user can login using "*** Email address is removed for privacy ***"

we can successfully create a subdomain in Microsoft admin center, but it will inherit the "managed" state of the main "contoso.com" domain.

as per this document: Change subdomain authentication type using PowerShell and Graph - Azure Active Directory - Microsoft Entra | Microsoft Docs

subdomain auth type can be changed, although i did notice the doc references an opposite situation where the main domain is federated.

is what i've described possible? will promoting the subdomain (deparment) to root and changing the subdomain authentication type to federated work without interfering the existing users in the main custom domain (contoso.com ) ?