Office 365 Domain Verification

[Michael]

Hi all,

 

I thought I'd give those of you planning O365 migrations a heads up of a problem I've spotted -

 

Initially when registering with O365, you need to confirm ownership of your school domain, typically ending in .sch.uk. The Microsoft O365 Console randomly generates an address, for example ms=12345678 which proves ownership.

 

So what's the problem you may ask?

 

Previously the randomly generated address remained static, but now it appears to be changing. By the time a school has filled out a form, signed, faxed/e-mailed and it's sent to the Local Authority, it may take days for the request to be processed by which time the randomly generated address changes; meaning I cannot confirm the domain ownership.

 

I don't know how long this has been in place and why Microsoft thinks it's necessary, but it's proving a nuisance to say the least! The point is, schools may be the legal owner but they may not necessarily have technical access to make changes directly to their school domain.

 

@EduTech - Can you confirm this change has now come into play? Thanks!

[MrFrostmaul]

Do you have a direct email or phone number to your local authority for the domain? as we just email ours and they do within a few hours for us.

[Michael]

Unfortunately no, but I have raised the issue this evening so hopefully I'll hear something tomorrow.

[achedgy]

Had this problem on a couple of occasions now.. Microsoft do presume you will have direct control of your own DNS.. As part of the planning, you will have to get the LA (or whoever controls your domain name) ready and waiting to add the record. From hitting the button that's gives you the address you have 8 hours till it changes..

[Michael]

This looks like a bug to me - every time I visit the domain verification page, the ms=12345678 is different. The irony is that it stills says (on the same page) to wait upto 72 hours for DNS.

 

Can someone who works at Microsoft highlight this problem please?

[FN-GM]

Why does the LA have control of the schools domain?

[Michael]

Why does the LA have control of the schools domain?

 

Just the way it is - I don't have a problem with that. The issue is the random address is being changed too frequently, which is a Microsoft issue.

[EduTech]

Hi Michael,

 

You should definitely not be seeing this kind of behaviour, the verification record does not change unless you remove and re-add the domain name. If possible, can you send me a domain name via PM so I can have a look.

 

I also just want to confirm, is it the portal where you are seeing the domain verification record change? if so, can you go and check PowerShell Console using Get-MsolDomainVerificationDns -DomainName contoso.com -Mode DnsTxtRecord and see if that shows the same behaviour.

 

Regards,

James.

[achedgy]

Hi Michael,

 

You should definitely not be seeing this kind of behaviour, the verification record does not change unless you remove and re-add the domain name. If possible, can you send me a domain name via PM so I can have a look.

 

I also just want to confirm, is it the portal where you are seeing the domain verification record change? if so, can you go and check PowerShell Console using Get-MsolDomainVerificationDns -DomainName contoso.com -Mode DnsTxtRecord and see if that shows the same behaviour.

 

Regards,

James.

 

That's not the case now. you're given a limited time (8 hours) not that it makes this clear. I only found out after spending a good amount of time on the phone to Microsoft support. After 8 hours the txt record will change..

Edited September 14, 2015 by achedgy
added info

[EduTech]

That's not the case now. you're given a limited time (8 hours) not that it makes this clear. I only found out after spending a good amount of time on the phone to Microsoft support. After 8 hours the txt record will change..

 

If possible can you PM me the SR number that you were given when you raised this Incident.

 

Many Thanks,

James.

[Michael]

PM sent, thanks!

[Michael]

This is ridiculous - it feels more like 8 minutes rather than 8 hours.

 

It appears as soon as we change the TXT record our side, I try and confirm ownership and it errors 'Can't Verify Domain'. Then I come out of the Control Panel, back into Domains and the address in the O365 Control Panel changes.

 

I just find it very ironic that it still mentions 'waiting upto 72 hours' for settings to propagate. It looks like Microsoft's DNS is broken to me...

[Michael]

I can confirm the address reads the same in Powershell. As I say, the issue appears to be when we enter the correct address for the GUI it cannot verify. The address then resets and you're forever going round in circles. Never had this issue with all the O365 migrations I've performed over the years.

[EduTech]

Folks,

 

If those of you getting upset could calm down slightly before we end up going on a major rant! The behaviour you are explaining is not expected the verification record should not change unless you remove / re-add the domain name. (we would of had a lot more issues if this has been normal behaviour in the past) from what I am hearing this sounds specific to portal, i.e. if you use powershell to Confirm-MsolDomain and that fails, I guess the record still stays the same and doesn't change where as the portal, seems to be forcing a update to the record if the DNS Record isn't picked up.

 

I am working on this at the moment, will update thread soon! :-)

 

Thanks,

James.

[Michael]

So just to confirm, is the Powershell command:

 

Confirm-MsolDomain -DomainName random.sch.uk

[Michael]

Have ran the above command in O365 and now I'm getting:

 

Confirm-MsolDomain : Unable to verify this domain because it is used elsewhere in Office 365. Remove the verified domai
n from the other service before adding it here.
At line:1 char:19
+ Confirm-MsolDomain <<<<  -DomainName random.sch.uk
   + CategoryInfo          : OperationStopped: ( [Confirm-MsolDomain], MicrosoftOnlineException
   + FullyQualifiedErrorId : Microsoft.Online.Administration.Automation.DomainNameConflictException,Microsoft.Online.
  Administration.Automation.ConfirmDomain

 

The good news is that the address hasn't changed in the O365 Control Panel, but it still isn't verified.

 

Is this basically saying someone else has registered and confirmed the same domain in another tenancy?

Edited September 14, 2015 by Michael

[EduTech]

Have ran the above command in O365 and now I'm getting:

 

Confirm-MsolDomain : Unable to verify this domain because it is used elsewhere in Office 365. Remove the verified domai
n from the other service before adding it here.
At line:1 char:19
+ Confirm-MsolDomain <<<<  -DomainName random.sch.uk
   + CategoryInfo          : OperationStopped: ( [Confirm-MsolDomain], MicrosoftOnlineException
   + FullyQualifiedErrorId : Microsoft.Online.Administration.Automation.DomainNameConflictException,Microsoft.Online.
  Administration.Automation.ConfirmDomain

 

The good news is that the address hasn't changed in the O365 Control Panel, but it still isn't verified.

 

Is this basically saying someone else has registered and confirmed the same domain in another tenancy?

 

Hi Michael,

 

Yes, In essence that means the domain is already verified against another Azure AD instance. so I have a few things to follow up on here, because the Office UI should be flagging that to you (when you add domain, or during the verification process, throwing that exception as a friendly error).

 

If anyone has an incident open already regarding this please drop me a PM with the SR Number.

 

Thanks,

James

[Michael]

Thanks for all your help yesterday James. In summary Link2ICT who support Birmingham schools have mass registered/confirmed all remaining schools over August who are still using Zimbra.

 

The web interface doesn't reveal the domain is already registered/confirmed in another tenancy, whereas Powershell does. Overall a waste of a good day because of poor communication and nothing published by Link2ICT that this has taken place.

[FN-GM]

The web interface doesn't reveal the domain is already registered/confirmed in another tenancy.

 

I did do Easter 2015, not sure why they would remove it.

[Michael]

I did do Easter 2015, not sure why they would remove it.

 

Interestingly the GUI only mentioned 'Cannot Verify Domain' and that's it. Somewhat lacking, whereas Powershell was more informative, but as good as it gets in terms of decrypting Microsoft log/error messages.

 

It still doesn't explain the odd behaviour of the address constantly changing. As others have suggested, O365 should warn at the registering stage that the domain is unavailable to avoid the headache of trying to work out why.

Edited September 15, 2015 by Michael

[EduTech]

Thanks for all your help yesterday James. In summary Link2ICT who support Birmingham schools have mass registered/confirmed all remaining schools over August who are still using Zimbra.

 

The web interface doesn't reveal the domain is already registered/confirmed in another tenancy, whereas Powershell does. Overall a waste of a good day because of poor communication and nothing published by Link2ICT that this has taken place.

 

We do have work in progress for it to communicate to you better if the domain is already verified against another tenant, I am getting an update on where we are with that as it's very much scenario dependant i.e. weather the domain has been DNS Verified in another tenant or weather it is e-mail verified and is classed as an un-managed tenant that was created as part of someone signing up for an IW service. It's a workstream that is being done, under a lot of care and attention because if we return the tenant name of where such a domain is already verified we have to be mindful of PII and protecting customers privacy etc. (i.e. some people don't want to expose if domains are verified or not as they don't want people to know that there domain is already verified) and the scenarios go on and on.. won't bore you with it all.

 

I am pleased that you managed to sort your particular issue, in terms of the behaviour where you stated the verification record value was being refreshed I am still going to following up on that and I am currently trying to re-produce this at the moment.

 

I wrote this article a few months back now: unable to verify domain name – Office 365 / Azure AD | James Evans - EduTech's Blog you may find consulting that interesting, as sometimes just because you cant verify the domain doesn't mean DNS hasn't propagated. ;-) also some domain namespaces or/ TLDs are specifically defined as restricted domains in code that we do not allow the domain to be added/verified. if you ever have any issues I would definitely recommend that you read the article I mentioned for some guidance and if still all fails contact Microsoft Support Team or/ drop me a PM and I'll do my best to help.

 

Thanks,

James.