Lock a domain in Apple Business Essentials
When a domain is locked, the organization can then create new Managed Apple Accounts using the verified domain. Existing Apple Accounts created before enabling the lock remain untouched. This option helps to ensure that moving forward all accounts using the domain are organizationally owned. To remove the lock, the domain must be removed.
Important: Locking a domain permanently prevents anyone from creating an Apple Account using that domain.
Lock a domain
In Apple Business Essentials, sign in with a user that has the role of Administrator or People Manager.
Select your name at the bottom of the sidebar, select Preferences
, then select Managed Apple Accounts 
.In the Domains section, select the domain you want to lock, select Manage, then lock the domain.
Read the information carefully, the only way to unlock a domain is to remove it from Apple Business Essentials.
Select Lock Domain.
Important: Locking a domain permanently prevents anyone from creating an Apple Account using that domain.
Do one of the following:
Close the window if you want to begin the domain capture process or federation process at a later time.
Federate the domain.
Select Get Started with Domain Capture to begin the domain capture process. See Capture a domain.
If you locked this domain in error, see Remove a domain.