Removing Custom Domains with Mail-Enabled Security Group Dependencies

The scenario involves removing a custom domain (contoso.com) that has significant dependencies, specifically 750 references across user accounts, application identifier URIs, and mail-enabled security groups. The critical constraint is to minimize manual changes.

Option A suggests manually renaming all references. With 750 objects, this is impractical and violates the 'minimize manual changes' requirement. It also ignores the technical necessity of handling mail-enabled security groups, which often have immutable attributes or require specific cleanup steps.

Option D is incorrect because you cannot delete the default domain in Microsoft 365. Furthermore, making it the default would not remove the dependencies; it would just change the primary context, leaving the same 750 references intact.

Option B proposes using the –ForceDelete option without changing mail-enabled security group references. In Microsoft 365, mail-enabled security groups are tightly coupled with Exchange Online. Deleting a domain that still has active mail-enabled security groups associated with it typically fails unless those groups are either removed or their email addresses/aliases are updated to point to another valid domain. Simply forcing deletion without addressing these specific object types usually results in an error or leaves orphaned data, which is not a clean solution.

Option C is the correct approach. You must first update or remove the references for the mail-enabled security groups (e.g., by removing their SMTP addresses or deleting the groups if they are no longer needed). Once these specific dependencies are resolved, you can use the –ForceDelete parameter on the Remove-MgDomain cmdlet (or equivalent admin center action) to remove contoso.com. This handles the stubborn mail-enabled objects explicitly while allowing the system to handle other references or confirming that they are cleared, thus minimizing manual heavy lifting compared to Option A, while ensuring technical validity unlike Option B.