Lock a domain in Apple Business Essentials
When locking a domain, only the organization can create new Managed Apple Accounts using the verified domain. Existing Apple Accounts created before enabling the lock remain untouched. This option helps to ensure that moving forward all accounts using the domain are organizationally owned.
Note: Locking a domain is a permanent process. To remove the lock, the domain must be removed from Apple Business Manager.
Lock a domain
In Apple Business Essentials, sign in with a user that has the role of Administrator or People Manager.
Select your name at the bottom of the sidebar, select Preferences
, then select Managed Apple Accounts 
.In the Domains section, select the domain you want to lock, select Manage, then lock the domain.
Read the information carefully, the only way to unlock a domain is to remove it from Apple Business Essentials.
Select Lock Domain.
Do one of the following:
Close the window if you want to being the domain capture process or federation process at a later time.
Federate the domain.
Select Get Started with Domain Capture to begin the domain capture process. See Capture a domain.
If you locked this domain in error, select Remove Domain, then select Remove Domain.