...
In order to use the DualShield to secure office 365 with MFA, you we will need to change your Office 365 custom domain from the Managed Authentication to the Federate Authentication , and set your DualShield SSO service as the federated identity provider . Furthermore, your custom domain cannot be set as the default domain. Office 365 does not allow the default domain to use federated authenticationfor Office 365.
If Furthermore, if your custom domain is currently set as the default domain, then you need to change the default domain to another customer domain or to your ".onmicrosoft.com" domain. Office 365 does not allow the default domain to use federated authentication. Please Please refer to the link below for the the instruction on how to set a different domain to be the default domain.
...
It is recommended that you have a tenant administrator account in your "onmicrosoft.com" so you don't lock yourself out of your tenant.