We are planning to activate My Domain in Production Org for developing lightning components. We have activated My Domain in Sandbox and conducting tests. We have checked for Hardcoded references to Instance in Templates, Custom Buttons, and VF pages. We are one week out from going live. Is there anything else we should be careful or check for before activating My Domain in Production that might affect the users or external integrations?
You need to take action based on the redirection policy during My Domain configuration.
So, based on the settings, in the user's browser old bookmark may not work. So you need to announce to organization's user.
External integration will continue to work if they don't hit My Domain URL and use login URL to integrate Salesforce. Same principle applies to data loader.
Rest of the precautions already been mentioned by @sfdcfox in his answer.
The main concern is any integration that doesn't follow best practices (which includes resetting the Endpoint URL from the
login() response). While rare, I have seen at least one situation where a "clever" developer used a regular expression to modify the login URL instead of just reading the value from the login response body, which resulted in a critical internal application failing.
If you have any non-commercial/internal integrations, make sure you check them properly. Also, you may want to check your Apex Code, Visualforce Components, and Lightning Bundles for hard-coded URLs as well, since that can also cause problems.
Once you're sure you're ready to go, consider activating the feature on the least busy day, if possible. For example, we have most of our sales happen on the weekend, yet there's nobody on duty if something goes wrong, so we deploy on Monday nights after normal business hours to minimize disruptions.