Microsoft Security | Microsoft Entra | Microsoft Entra ID
A cloud-based identity and access management service for securing user authentication and resource access
Unable to Delete domain name
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(12.8, 55.00000000000001%, 11%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EHG%3C/text%3E%3C/svg%3E)
Harry Guo
0
Reputation points
Hello, I'm getting the following error:
Unable to delete domain name 'byndidharry.net' from Beyond Identity Sales Engineering
Details
Request Id: c3c4cf84-27d9-4609-9c9-1ca75a2595a5
Time Stamp UTC: 2025-03-05T14:44:58
Code: Request_BadRequest
Message: The read criteria match more than one object.
I have no idea what this means since I have this page saying I've met all the criteria for deleting a domain:
Is there anything I'm missing? Thank you.
Microsoft Security | Microsoft Entra | Microsoft Entra ID
{count} votes
-
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(128, 8%, 22%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EA%3C/text%3E%3C/svg%3E)
Anonymous2025-03-05T18:32:59.5766667+00:00 Hello Harry Guo,
Thank you for posting your query on Microsoft Q&A.
As per the description, I understand you are getting bad_request failure while deleting a custom domain from your tenant. And you have already removed all users, groups and applications from the tenant.
You need to remove few more below resources to make sure the domain is deleted.
If users are synchronized from on-premises, turn off the sync
Remove all Devices associated with the domain.
- Ensure to remove DNS records that are associated with the domain name.
If the domain is federated, make sure to remove the federation.
Ensure no email services are using this domain name.
No active subscriptions or resources using this domain name.
If you also activated license-based subscriptions for your organization, like Microsoft Entra ID P2, Microsoft 365 Business Standard, or Enterprise Mobility + Security E5 you can't delete an organization until the subscriptions are fully deleted. The subscriptions must be in a Deprovisioned state to allow organization deletion. An Expired or Canceled subscription moves to the Disabled state, and the final stage is the Deprovisioned state.
Microsoft is aware that customers with certain tenant configurations might be unable to successfully delete their Microsoft Entra organization. We're working to address this problem. If you need more information, contact Microsoft support.
I suggest you refer the below document.
https://learn.microsoft.com/en-us/entra/identity/users/directory-delete-howto
I hope this information is helpful. Please feel free to reach out if you have any further questions.
If the answer is helpful, please click "Accept Answer" and kindly upvote it. If you have extra questions about this answer, please click "Comment".
-
Harry Guo 0 Reputation points
2025-03-05T20:34:10.5+00:00 Hi @Anonymous , thank you for your response!
Yes, we've deleted all associated resources, and the domain is Managed and not federated.
However, we run into an extremely strange issue with the federation. As you can see below, the domain is managed.
However, there are still federation settings associated with it.
When I try to delete it, I get the following error (similar to the one I get on the Azure portal).
I have seen something adjacent to this in this post: https://learn.microsoft.com/en-au/answers/questions/2129640/new-mgdomainfederationconfiguration-is-failing-wit
It seems like even though the domain is managed, the federation object is still there.
-
Anonymous
2025-03-08T00:52:45.87+00:00 Hello Harry Guo,
Please confirm if the domain in Azure portal is showing as Managed or Federated and it is not set as primary domain under Custom Domain Names in your tenant.
Microsoft will not allow a domain name to be verified with more than one Microsoft Entra tenant. Once you delete a domain name from your tenant, you will not be able to re-add/re-verify it with your Microsoft Entra tenant if it is subsequently added and verified with another Microsoft Entra tenant.
I am sharing the Tenant ID in which your domain is verified in a private message. Please check and confirm that ID belongs to your tenant.
-
Harry Guo 0 Reputation points
2025-03-10T14:30:42.97+00:00 Hi @Anonymous
Unfortunately I didn't have my email notifications set up, could you just DM me again? I should receive an notification at an email that I have access to.
And yes, I have confirmed that this domain is showing as Managed in the Azure portal and not set to primary.
-
Anonymous
2025-03-12T01:01:42.4833333+00:00 Hello Harry Guo,
IT Admin deleting the domain will need to use their UPN which is not on the verified domain name, such as the domain the admin is trying to delete is "byndidharry.net ", the IT Admin cannot be logged in as "@byndidharry.net", rather the UPN needs to be "@contoso.onmicrosoft.com"
And I suggest you delete the domain through MS Graph as mentioned in the below document
DELETE /domains/{domainsId}/federationConfiguration/{internalDomainFederationId}
Remove the Domain from Any Active Subscriptions
If the domain is linked to any active Azure subscriptions or resources (like virtual machines, storage accounts, or Azure Active Directory B2B), you’ll need to either:
Change the domain associated with the resources (if possible).
Or transfer ownership or subscription management to a different domain.
DNS Records: Check if DNS records (like MX, CNAME, etc.) are configured for the domain in Azure DNS.
If your domain is verified in Azure AD (i.e., you own it), you need to ensure that the verification is removed before deleting it.
Login to Entra ID in Powershell and execute the below command to delete your domain.
Connect-Entra -Scopes 'Domain.ReadWrite.All'
Remove-EntraDomain -Name byndidharry.net
Reference :
-
Harry Guo 0 Reputation points
2025-03-12T13:54:51.9033333+00:00 @Anonymous I've tried all 3 methods you've mentioned and still failed.
- I am logged in as a user thats .onmicrosoft.com. and tried to delete the domain. There are no associated objects with this domain anymore. I have all checkmarks when during domain deletion and confirmed there are no objects.
- I tried the Remove-EntraDomain -Name byndidharry.net while logged in as the same user above. Same result.
- There's definitely some backend issue with the federation object. My domain is "Managed" but yet the federation object still exists, and I am unable to delete it.
First, I validated that my domain is set to managed. The Azure Portal says the same information.
Second, I checked if there was a federation object. There is. I don't know why there is, since the domain is "Managed".
Finally, I tried to delete the domain federation object as you mentioned. But I get the following error that the federation configuration doesn't exist (although it clearly does from the above result). I've tried this command directly via Microsoft Graph too and get the same result.
It seems like there are 2 errors here:
- The GraphAPI has some bugs.
- There some database issue with this entry.
- I am logged in as a user thats .onmicrosoft.com. and tried to delete the domain. There are no associated objects with this domain anymore. I have all checkmarks when during domain deletion and confirmed there are no objects.
-
Harry Guo 0 Reputation points
2025-03-19T13:56:27.65+00:00 @Anonymous any updates on this?
-
Harry Guo 0 Reputation points
2025-03-24T13:20:45.0633333+00:00 @Anonymous any updates on this?
-
Anonymous
2025-03-31T05:24:43.53+00:00
Sign in to comment
Sign in to answer