Changing IT providers: a handover checklist
The biggest risk in changing IT companies is what the old one still controls. Here is how to get your accounts, licenses and backups back safely.
Most businesses that change IT providers worry about the new company. The bigger risk usually sits with the old one. Over the years, your provider may have registered your domain, created the admin accounts, bought your licenses and set up your backups, and the keys to all of that can live in their systems instead of yours. A good handover gets those keys back before anyone gives notice. This checklist is the order we'd suggest, whether the split is friendly or not.
Before you tell anyone: map what you depend on
Start quietly, with a list of everything the business can't run without, and write down who controls each item today. Don't guess. Log in and look, or ask for a routine "documentation review" if you can't.
- Domain and DNS. Who is the registrant, which email address gets renewal notices, and who can change the records? Lose this and you can lose your email and website together.
- Microsoft 365 or Google Workspace. Who holds the global admin account, and is it a named person at your company?
- Firewall, Wi-Fi and switches. Do you have the admin logins and a saved copy of the configuration?
- Backups. Where is the data stored, whose account does it sit under, and what happens to it when the contract ends?
- Line-of-business software. Accounting, practice management and similar systems often have a vendor portal listing your IT company as the contact.
- Remote access and security tools. What is installed on your computers, and who is paying for it?
Get your own admin access first
This is the step that matters most. Before any notice goes out, make sure someone at your company has a working administrator account on the systems above, with its own MFA tied to a device your business controls. For Microsoft 365, keep one extra "break-glass" admin account with a long password stored safely offline. Test each login. Our guide to password and account security covers how to store shared credentials properly.
Read the contract before you give notice
Look for the notice period, any auto-renewal date, and what the agreement says about handing over documentation and passwords. Check who actually owns any hardware or licenses you've been paying for monthly. Firewalls and backup appliances are sometimes supplied as part of the service and may need to go back. If something is unclear, ask a lawyer rather than assuming.
Plan for overlap, not a hard switch
Try to keep both providers in place for a period, with the new one starting before the old one stops. These items need the most care:
- Licenses. Microsoft 365 subscriptions bought through a partner have to be moved or replaced, not just forgotten. Agree a date so nobody's mailbox is affected by a lapsed subscription.
- Backups. Start the new backup and confirm it works before the old one ends, then decide how long you need to keep the old history. A test restore is the only real proof.
- Security tools. Your old provider's antivirus and monitoring agents usually stop when the contract does. Replace them machine by machine so no computer is left unprotected, and so two security products aren't fighting each other.
- Support coverage. Tell staff exactly who to call, and from which date.
After the switch: close every door
Being on good terms isn't a reason to skip this. It's simply how access should end.
- Remove the old provider's user accounts and delegated partner access. In Microsoft 365, check Partner relationships in the admin center.
- Change admin passwords on firewalls, servers, Wi-Fi and vendor portals, and any shared passwords their staff knew.
- Uninstall their remote access software from every computer, and check for VPN accounts.
- Update your contact details with your domain registrar, internet provider and software vendors, so renewals reach you.
If the old provider won't cooperate
Most handovers are professional, but some go quiet, and some providers simply close. You can usually still recover control, because you can prove the business owns its domain and accounts. Registrars and Microsoft have processes for this, though they take time and paperwork, so start early and keep your contracts and invoices together. Don't let anyone wipe a server or cancel a service until you've confirmed where your data is.
Need help with the move?
We can work through the list with you, take over day-to-day small business IT support, or set up managed IT services. Call (213) 986-4855 to talk it through.