Before you switch IT providers, get every admin login, password vault, domain account and backup key back into your company’s hands, and keep the old provider in place until the new one has confirmed it can reach everything. The safest handoff runs a few weeks of overlap and works from a written checklist like the one below. Skip a line and you can end up locked out of your own email, domain or backups the day the old contract ends.
Key takeaways
- Your company should own the global admin account for Microsoft 365 or Google Workspace, the domain registrar login and the password vault. Fix that first.
- Remove the old provider’s Microsoft partner access and delegated admin roles from your tenant after the handoff. Ending the contract does not remove them.
- Get backup console access and encryption keys before the old provider’s backup service is canceled.
- Plan an overlap and a cutover date in writing, and check your contract’s notice period before you announce anything.
When should you start the handoff?
Start with your current contract. Find the notice period, any termination fee, and whatever it says about returning documentation and credentials. Pick the new provider, set a cutover date, then give notice. Most clean handoffs run two to six weeks of overlap, depending on how much documentation exists and how many systems are involved.
Keep the tone professional. You need the outgoing provider’s cooperation for the steps below, and most providers handle exits well when they get a clear list and a reasonable timeline.
Which accounts must you take back?
Microsoft 365 or Google Workspace. Make sure at least one global admin (Microsoft) or super admin (Google) account belongs to someone at your company, not the provider. Add a break-glass admin account with a long password stored offline, so you are never locked out by a single person. Then review every admin account and remove the ones you can’t explain.
Domain registrar and DNS. Your domain is your email. Get the registrar login (GoDaddy, Network Solutions, Squarespace and so on), confirm the account is in your company’s name with a company email address, and note where DNS is hosted if that is somewhere else. If your Microsoft 365 was bought through GoDaddy, read our guide on how to defederate Microsoft 365 from GoDaddy before you change anything.
Firewall, switches and Wi-Fi. Get the admin credentials and any cloud management accounts (Meraki, UniFi, SonicWall, Fortinet and similar), plus the firewall’s support and license renewal details.
Password manager. If the old provider kept your passwords in its own vault, request a full export of every entry that belongs to your company, then change the important ones once the new provider is in place.
How do you protect your backups during the switch?
This is where handoffs go wrong most often. If the old provider owns the backup account, canceling the contract can cancel the backups and delete the history. Before anything is turned off:
- Get access to the backup console, or have the provider export the most recent full backup to storage you control.
- Get the encryption keys or passphrases. An encrypted backup without its key can’t be restored.
- Have the new provider run a test restore from the old system, and keep the old backups until the new ones have run cleanly for a few weeks.
- Check Microsoft 365 or Google Workspace backup separately. It is often a different service from server and workstation backup.
What does the old provider need to remove?
Monitoring and remote access agents. The old provider’s RMM agent, remote control tool and endpoint security software are on every computer. Agree on who removes them and when. Removing endpoint protection before the new tools are installed leaves devices unprotected, so swap them in a set order.
Microsoft partner access. Many providers manage Microsoft 365 through a partner relationship with delegated admin roles, known as GDAP. That access survives the end of a contract. After the cutover, go to the Microsoft 365 admin center, open Settings, then Partner relationships, select the old provider and remove its roles. Microsoft documents the steps in its guide to customer-led termination of a GDAP relationship. If the old provider also resold your licenses, plan the license transfer with the new provider so there is no gap in service.
Shared and service accounts. Change the passwords on any shared logins, service accounts and vendor portals the old provider used.
What documentation should you ask for?
- A device inventory with serial numbers, ages and warranty dates.
- A network diagram with IP ranges, VPN settings and firewall rules.
- Software license keys and subscription renewal dates.
- Internet provider account numbers, circuit IDs and support phone numbers.
- Vendor contacts for your phone system, printers, line-of-business software and building access.
- Open tickets, known issues and anything that was “on the list.”
Whatever the old provider can’t produce, the new provider should rebuild during onboarding. With us, onboarding and documentation are part of every managed IT plan, so that rebuild is included.
Frequently asked questions
Can our old IT provider refuse to give us our passwords?
Your contract governs what they must return, so read it first. In practice, the accounts are in your company’s name and most providers hand them over when asked clearly. If they won’t, Microsoft and Google both have account recovery processes for verified owners.
How long should the overlap be?
Long enough for the new provider to confirm access to every system on the checklist and complete a test restore. For most small and midsize companies that is two to six weeks.
Will switching providers cause downtime?
It shouldn’t. Most of the work happens in the background. The riskiest moments are DNS changes and security tool swaps, which should be scheduled after hours.
Do we need to tell our cyber insurance carrier?
Check your policy. Some carriers ask about your IT and security vendors at renewal, and a change in tools such as MFA or endpoint detection may need to be reported.
If you are planning a switch and aren’t sure who actually holds your admin accounts, domain or backup keys, Boston Managed IT will help you find out before you give notice. Call (617) 322-5155 or visit bostonmit.com/contact for a free 15-minute IT handoff review.
— Boston Managed IT
