On Design and Implement Microsoft 365 Services, We need to know how and why to manage domains in Microsoft 365 and this section covers the below topics.
- Add and configure additional domains
- Configure user identities for new domain name
- Configure workloads for new domain name
- Design domain name configuration
- Set primary domain name
- Verify Custom Domain
Add and configure additional domains
When you sign up for Office 365, it includes a default domain name like domainname.onmicrosoft.com. Adding a Domain in Office 365 will help you to have your domain name in your email address instead of that default domain. You need to prove the domain ownership by adding a TXT record on your DNS to add the domain in Microsoft 365.
To add a default domain:
Login to O365 Admin Portal https://portal.office.com/adminportal/home -> Setup -> Domains -> Add a Domain -> enter your domain name -> Verify the domain by creating a TXT record that shows up -> Setup Online Services that you want to use -> Update the DNS records -> Complete the steps.
Tips: To verify the domain, Office 365 will show an option where if domain registered under GoDaddy, Office 365 will verify the domain on your behalf when you login to your GoDaddy account or you can create TXT record that shows up on the domain addition page.
TXT record verification method prompts for a TXT record or an MX record can be created to show the proof of domain ownership.
If you create a MX record, make sure you are ok to receive emails through Microsoft 365 Exchange Online Protection as your email gateway. If you have an existing email gateway in On-Premise and continues to receive the internet emails through the existing system, then do not verify the domain using MX record. Always prefer TXT record to verify the domain.
Configure user identities for new domain name
Microsoft 365 have different Identity models available that you can choose based on your requirement.
Cloud Identity: User Identity management will be only in Office 365 (Azure AD). No On-Premise servers required to manage users. All the objects management, authentication and authorization done only in Cloud (Microsoft 365 Azure AD).
Synchronized Identity: Identities synchronized from on-premises directory to Office 365 (Azure AD) and object management done at On-Premise AD. Passwords Hash can be synced so that users have the same password in on-premises AD and in the cloud Azure AD. On-Premise and Office 365 will have same identity after the Synchronization but Users has to sign in every time when accessing On-Premise and Office 365 application, no single sign on experience.
Federated Identity: Identities synchronized from on-premises directory to Office 365 (Azure AD) and user management done at On-Premise AD. Identities Synced to Azure AD used to enable the Office 365 services by assigning a license. Users always authenticate in on-premise AD to access a Microsoft 365 cloud applications via Federated Authentication (ADFS and ADFS Proxy combination). Federated Authentication provides for Single Sign On experience.
Tips: We can see the current authentication method at Azure AD Portal -> Azure AD Connect.
If you want to change the Authentication method, change it from Azure AD connect configuration. We can see the current authentication method at Azure AD Portal -> Azure AD Connect
Configure workloads for new domain name
When you verify the custom domain, it will provide an option to configure the record required for enabling the workloads\services like Exchange, Skype for Business, Teams, SharePoint\OneDrive and Mobile Device Management for Office 365. We need to plan the services that we are going to be enable for the organization and when enabling, it will show the DNS records that is required for those services. Once the records created in your DNS (Internet), the services enabled for that domain will be verified and the licensed users can access the service.
Tips: Office 365 can register TXT records on your behalf if you sign in to GoDaddy account or you can manually create the TXT records required for services enabled.
Based on the workload selection, Office 365 will prompt you to create the required records. Other Office 365 workloads like Planner, Forms and PowerApps do not require a DNS record.
In addition to the above, we need to know how to enable the services and do the initial configuration for the below Microsoft 365 workloads
Windows 10 Enterprise
Office 365 (EXO, SPO, OD4B, Teams)
Enterprise Mobility + Security
Design domain name configuration
Designing Domain Name includes, adding a custom domain like superhybridcloud.com, sub domain like support.superhybridcloud.com and multiple domains like learnexchangeserver.com, learnHybridCloud.com to your Office 365 Subscription.
We can add up to 900 domains in Microsoft 365 domain settings. However, you need to verify the proof ownership for each domain.
Tips: If you are using Cloud Identity, sub domain additions automatically verified. However, the DNS records should be created for the services enabled for that domain.
If you have a requirement to add a sub domain, do not setup Microsoft to manage your DNS by creating NS records.
If the parent domain is federated identity, sub domains can be added only from the ADFS servers. You need enable the services once the sub domain added from ADFS server.
PowerShell: New-MsolFederatedDomain -DomainName support.superhybridcloud.com
Set primary domain name
If we add multiple domains in Office 365, we have the option to set one domain as Primary Domain.
To Set the Primary Domain:
Login to O365 Admin Portal https://portal.office.com/adminportal/home -> Setup -> Domains -> Select the domain -> Set as Default.
Tips: If we create user objects in Azure AD, the UPN or the email address stamped with the default domain name – domainname.onmicrosoft.com. This is applicable for Cloud Identity only or when the objects created directly in Office 365.
Deploying Windows 10 Enterprise and Intune Setup has a prerequisite to validate the primary domain.
Verify custom domain
If we add an additional domain, it is referred as the custom domain (you need to prove that you are the owner of that domain to Microsoft) and create the DNS records for each Office 365 workloads. Custom domain is nothing but the email addresses that you want on the email addresses for the mailboxes in Microsoft 365.
To Set the Custom Domain, login to O365 Admin Portal https://portal.office.com/adminportal/home -> Setup -> Domains -> Add the domain -> verify the domain by creating the TXT record provided.