Microsoft Exchange Online: Remove-DkimSigningConfig cmdlet now available to tenant admins

Introduction

To improve self-service capabilities and reduce support dependency, Microsoft has made the Remove-DkimSigningConfig cmdlet available to tenant administrators. This cmdlet enables admins to remove obsolete DomainKeys Identified Mail (DKIM) signing configurations directly from Exchange Online PowerShell, helping clean up configurations when domains are removed from a tenant.

When this will happen

This feature is already enabled worldwide, including in special clouds. Rollout dates:

• Worldwide: June 6–10, 2025
• GCCHigh: August 6–12, 2025

How this affects your organization

Who is affected: Tenant administrators managing DKIM configurations in Exchange Online with either the Transport Hygiene management role or the Security Administrator role in Entra ID.

What will happen:

• Admins can now run Remove-DkimSigningConfig directly using Exchange Online PowerShell (requires ExO v3.7 module).
• No escalation to Microsoft support is needed for DKIM cleanup.
• Obsolete DKIM configurations for removed domains can be self-managed.
• The cmdlet is available by default for eligible roles.
• This cmdlet does not replace any existing tools or processes; it introduces a new capability for tenant admins to manage DKIM cleanup independently.

What you can do to prepare

• Ensure you have the required role (Transport Hygiene or Security Administrator).
• Upgrade to Exchange Online PowerShell module v3.7.
• Use Connect-ExchangeOnline and run Remove-DkimSigningConfig as needed.
• Update internal documentation for DKIM management procedures.

Learn more: 

• Exchange Online PowerShell | Microsoft Learn
• Remove-DkimSigningConfig | antispam-antimalware | ExchangePowerShell | Microsoft Learn

Compliance considerations

No compliance considerations identified, review as appropriate for your organization.