ISSUE
While configuring DualShield MFA for Office 365, you may see an error below
Set-MsolDomainAuthentication : You cannot remove this domain as the default domain without replacing it with another de fault domain. Use the the Set-MsolDomain cmdlet to set another domain as the default domain before you delete this domain.
CAUSE
This error message appears due to Microsoft's restriction on federating default domains. To prevent loss of administrator access, Microsoft requires that only non-default domains can be federated.
RESOLUTION
To resolve this issue, set a different domain to be the default domain.