Unmanaged tenant holds our company domain — external admin takeover / domain verification failing

Question

Our company domain [Moderator note: personal info removed] is verified in a Microsoft Entra tenant that nobody in our organization is able to administer. We need to move the domain to a tenant we control, and domain verification keeps failing.

Background

Our company email runs on Google Workspace. We have never deployed Microsoft 365, Exchange Online, Teams, or any other Microsoft service on this domain.

In April 2018, an Azure DevOps invitation (Visual Studio Team Services at the time) was accepted using an [Moderator note: personal info removed] address. We believe this triggered self-service sign-up and created a viral/unmanaged tenant that claimed the domain.

Evidence that the domain is held elsewhere:

• • [Moderator note: personal info removed] returns NameSpaceType: Managed and IsFederatedNS: false
• The OIDC discovery endpoint for the domain returns issuer tenant [Moderator note: personal info removed]

Current state

• We hold Global Administrator in a separate tenant, [Moderator note: personal info removed], and want the domain there.
• • [Moderator note: personal info removed] was added to that tenant and shows as Unverified.
• The TXT record [Moderator note: personal info removed] is published at the domain apex in Route 53 and resolves correctly (confirmed via dig).
• Domain verification via Entra ID portal still fails with: "We can't verify the domain name. Make sure you have added the record above at the registrar..."
• Domain verification via Graph API with forceTakeover = true (following External admin takeover procudeure form here: https://learn.microsoft.com/en-us/entra/identity/users/domains-admin-takeover) also fails.

Questions

1. Is external admin takeover the correct path here, and does it require anything beyond the TXT record?
2. Is the verification failure expected because another tenant holds the domain?
3. Is there any other procedure we should follow to get this domain verified?
4. If a support ticket is required, which support plan and case category should we use? We currently have Basic on an active pay-as-you-go subscription.

Any guidance appreciated.

Answer 1

Hi Marcio, 

Good day. Thank you for the clear explanation of your situation. 

As this is a user-to-user community forum, I do not have the ability to directly access or modify your account or service. However, I can provide guidance, recommend next steps, share applicable resources, and direct you to the appropriate support channels so the issue can be investigated further. 

Based on your description, it appears that your domain is currently stuck or associated with another Microsoft Entra tenant that your organization does not administer. If that is the case, standard domain verification in your current tenant may continue to fail, even if the DNS TXT record has been published correctly. 

In this scenario, you may need Microsoft Support to review the domain ownership and assist with releasing the domain from the other tenant, or guide you through the appropriate recovery process, once they verify that your organization is the legitimate owner of the domain. 

For creating a support request, Microsoft provides a support channel for business tenants through the Microsoft 365 admin center. You can try opening a ticket from: 

• Sign in to the Microsoft 365 Admin Center with your Microsoft administrator account.
• On right bottom corner click on "Help & support"     
• 
• Describe your issue briefly then choose the "Contact support".    
• 
•  You may be offered options for chat or call depending on your region and support availability. 

For the domain ownership verification process, please prepare the DNS verification record and any related evidence in advance. When a Microsoft Support engineer contacts you, they may ask for additional information to confirm domain ownership and to validate the tenant relationship. They should be able to guide you on the exact information required. 

I recommend preparing the following information before opening the ticket: 

• Affected domain name 
• Tenant ID of the tenant you currently control 
• Tenant ID returned by the OIDC discovery endpoint, if available 
• Screenshot showing the domain as Unverified in your tenant 
• Current DNS TXT verification record 
• dig TXT domain.com or nslookup output confirming the TXT record resolves correctly 
• Graph API request and response when using forceTakeover=true 
• Confirmation that the domain is used with Google Workspace 
• Confirmation that Microsoft 365, Exchange Online, and Teams were not deployed for this domain 
• Background that an Azure DevOps/VSTS invitation in 2018 may have triggered the original tenant creation 

For detailed guidance on how to open a support ticket with Microsoft Support, please refer to: Get support - Microsoft 365 admin | Microsoft Learn  

If the domain is currently verified in another managed tenant, then the verification failure is expected behavior. A custom domain cannot be verified in two Microsoft Entra tenants at the same time. In that case, the domain must either be removed from the existing tenant by an administrator of that tenant, or Microsoft Support will need to assist after validating your domain ownership. 

I hope this helps move the case forward. Should you have any further questions or need additional assistance, please feel free to share them in the comment below. I'm very happy to help.  

---

If the answer is helpful, please click 'Yes' and kindly upvote it.

Note: Please follow the steps in the forum documentation to enable e-mail notifications if you want to receive the related email notification for this thread.