Microsoft Security | Microsoft Entra | Microsoft Entra ID
A cloud-based identity and access management service for securing user authentication and resource access
How can i prove ownership of a domain if in another tenant?
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(217.60000000000002, 95%, 31%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EQ%3C/text%3E%3C/svg%3E)
Quality
20
Reputation points
Hi,
i looking for a solution in that scenario:
The domain is within a tenant, but I have no idea which account it is associated with. I can prove ownership of the domain, but I don't know how I should/can do so.
Has anyone else experienced a similar situation? Thank you very much.
Microsoft Security | Microsoft Entra | Microsoft Entra ID
{count} votes
-
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(275.2, 16%, 36%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EV%3C/text%3E%3C/svg%3E)
VPHAN 17,015 Reputation points Independent Advisor2025-12-18T12:04:34.42+00:00 Hello Quality,
This is a frequent scenario known as a "shadow" or "unmanaged" tenant issue, often caused when users in your organization previously signed up for self-service products like Power BI using their domain email addresses, effectively creating a directory instance without an IT administrator. The most immediate solution is to attempt an "Internal Admin Takeover" to seize control of this unmanaged tenant. To do this, you first need to ensure you can receive email at an address on the target domain (e.g.,
******@yourdomain.com), which may require you to temporarily point the domain's MX records in your DNS to a mail server you control. Once you can receive mail, sign up for a free Microsoft service that supports self-service, such as Power BI Free, using that email address. Upon signing in, navigate to the Microsoft 365 Admin Center (admin.microsoft.com). The system should detect the unmanaged state and present a "Become the Admin" wizard. This workflow will provide you with a specific TXT record to publish to your DNS zone. Once propagated, Microsoft verifies your control over the domain and promotes your account to Global Administrator, allowing you to either manage that tenant or remove the domain entirely.If the takeover attempt fails or you receive a notification that the domain is associated with a "managed" organization, you cannot resolve this via the portal because security protocols prevents the disclosure of the current administrator's identity. In this specific case, you must contact Microsoft Support, specifically the Data Protection team, to request a manual domain release. You will need to explain that the domain is locked in an unknown tenant and that you have DNS control. The support engineer will execute a manual validation process by providing you with a unique TXT record (often containing a ticket number or a verification string) to place in your DNS. Once they verify this record, they can forcibly strip the domain from the inaccessible tenant on the backend, freeing it for use in your correct environment.
I hope you've found something useful here. If it helps you get more insight into the issue, it's appreciated to accept the answer. Should you have more questions, feel free to leave a message. Have a nice day!
VP
-
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(233.6, 85%, 32%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EVS%3C/text%3E%3C/svg%3E)
VEMULA SRISAI 5,095 Reputation points Microsoft External Staff Moderator2025-12-18T14:55:56.8366667+00:00 Hello Quality ,
If your custom domain has already been verified in another Entra directory. You can do this by entering your domain name in the following URL to retrieve the tenant ID where it is verified:
https://www.whatismytenantid.com/
Once you have the tenant ID, verify whether it belongs to your tenant. If the tenant ID is different and you do not own that directory, the only option is to contact the Data Protection team via a support ticket to request the removal of the domain verification from the existing Entra ID tenant. After the removal, you should be able to verify the domain in your tenant without any issues.
To involve Data Protection team via a support ticket, I need a few details from you. As this information contains Personally Identifiable Information (PII), please share the following details via private message:
- Custom domain Name:
- Your tenant ID:
- Contact Email address:
- Contact Phone Number:
- Country
- TimeZone
Once you send me these details via private message, we can connect offline to discuss further and assist you in resolving this issue.
-
Quality 20 Reputation points
2025-12-22T10:13:13.6233333+00:00 Thank you for ur support. But im actually with no solution
Sign in to comment
Sign in to answer