If you bought Microsoft 365 through GoDaddy, you do not fully own your tenant. GoDaddy holds the federation, which means it controls authentication and sits in the admin chain, and that is why Entra ID, Defender, Purview and direct Microsoft support are all either missing or half-working. Defederation is the process of taking that control back.
It is a small job with a large downside, which is an awkward combination to buy. The work itself is usually two to four hours. Get the order of operations wrong and you can delete every user in the tenant.
Defederation is not a migration
Defederation converts your domain from federated authentication to managed authentication. Your users, mailboxes, files and Teams history stay exactly where they are. Nothing moves, and the visible disruption is a password reset.
The distinction is commercial rather than technical. A good part of this market will quote you for a full mailbox migration when what you need is a PowerShell change and a round of password resets, and the two jobs are priced nothing alike. If a provider cannot draw that line on a first call, you are talking to the wrong provider.
The ordering mistake that deletes every user in your tenant
There is one sequencing trap, and it is the thing you are really paying somebody to get right. If you cancel your GoDaddy Microsoft 365 subscription before GoDaddy has been removed as delegated admin, the accounts go with it. Recovering means a Microsoft support case and real downtime, and some of it may not be recoverable at all.
Every firm on this list knows that, and it is the reason the cheapest option is not always doing it yourself. The full order of operations is in the FAQs below.
What we weighted
The six standing criteria at /methodology, reweighted for a fixed-scope engagement rather than a retainer.
- Specialisation and fit · 30 · Does the firm sell defederation, or has it only explained it
- Commercial transparency · 20 · This is a few hours of scoped work, so a published price is reasonable to expect
- Documented outcomes · 20 · Tenants defederated and downtime incidents are checkable numbers
- Client evidence · 15 · Named clients, not sector labels
- Independent recognition · 10 · Microsoft partner tier and third-party listings
- Tenure · 5 · Lowest weight here, because this is a recent problem that rewards current practice
We ranked the firms that sell this work, not the firms that have written about it, and that distinction did most of the sorting. Every entry was checked against the firm's own site, and a price is printed only where the firm publishes it itself.
What each firm publishes
Seven of the nine quote on request. That is worth knowing before you start calling, so it is said once here rather than against every entry.
- A published price · Apps4Rent at $40 per user, Riverside Cloud at $350 flat. Nobody else names a figure.
- Checkable outcome numbers · CyberQuell states more than 30 tenants defederated with no email downtime. Apps4Rent states hundreds of GoDaddy projects inside more than 10,000 migrations.
- Defederation as a named service · Apps4Rent, CyberQuell, MedhaCloud, Riverside Cloud, Sourcepass and Boston Managed IT. iCorps Technologies takes it inside a managed IT relationship. Oxford Computer Group and Ravenswood Technology Group do not name it, so the fit there is read from their identity practice.
- A stated coverage limit · Sourcepass, for eight US states. No other firm states one.
The right choice here depends less on who is best and more on what your tenant looks like and how much certainty you want before you commit.
A GoDaddy tenant under 50 seats. Apps4Rent at $40 per user or Riverside Cloud at a flat $350 are the two you can price without a call. Under about nine users the per-seat option is cheaper, above it the flat fee is. Both are doing the same few hours of work.
You want a fixed price before you commit. Riverside Cloud is the only firm selling this as a product with a published number and no scoping call. Apps4Rent is the only one publishing a per-seat rate. Everybody else on this list will quote you.
You are an MSP taking over a client tenant. GoDaddy federation blocks GDAP through Partner Center, which is usually how this problem finds you. MedhaCloud runs a white-label practice so the work can be done under your name. CyberQuell sells white-label SOC alongside, if you want to keep the tenant monitored afterwards.
You are decommissioning ADFS across an enterprise estate. This is a different job from a GoDaddy tenant and most of this list is not built for it. The FAQ below names the two identity consultancies here and explains why that engagement runs in months rather than hours.
You want the security work done at the same time. CyberQuell, iCorps Technologies and Sourcepass all run security practices alongside, so the tenant can be hardened and monitored rather than handed back on the day. A tenant that has just changed hands is worth a look at conditional access and admin roles regardless.
You would rather do it yourself. Microsoft publishes the procedure and it is genuinely followable if you are comfortable in PowerShell and the Microsoft 365 admin centre. What you are paying a provider for is the sequencing risk, not the difficulty.
Ask every provider these
- Are you defederating in place, or migrating data? What is the price difference between the two?
- How many GoDaddy tenants have you defederated, and how many had email downtime?
- What is the total cost including new Microsoft licences, not just your fee?
- In what order will you remove GoDaddy's delegated admin role and cancel the subscription?
- What do I get in writing at the end, and who holds the break-glass admin account?