Switching IT providers? The MSP handover checklist.

Before you give notice: establish your own root

1. 1
   Get tenant admin in the business's hands

   At least one Global Administrator (M365) or super admin (Workspace) on an account your business controls — not the MSP's engineer accounts. Verify you can actually sign in. This single step converts every later dispute from a hostage situation into an inconvenience.
2. 2
   Confirm domain and DNS control

   Registrar account holder, DNS host, nameservers — run the lookup and know where each lives. MSPs frequently hold these 'for convenience.'
3. 3
   Inventory what they manage

   Tenants, licences, firewall/network gear and their admin logins, endpoint agents (RMM), backup systems and their storage, password vault, phone system, warranties. Ask for their asset list too — good MSPs maintain one.

The handover items

1. 1
   Licences and subscriptions

   If Microsoft/Google licences were bought through the MSP (a CSP/reseller arrangement), they don't automatically follow you — the new provider or the business takes over billing for the tenant. Sequence this so nothing lapses mid-switch.
2. 2
   Admin credential transfer

   Every system on the inventory gets a documented admin handover: tenant roles, firewall admin, switch/AP controllers, backup consoles. New provider verifies each before the old one's access ends.
3. 3
   Backups — before anything else changes

   Confirm where backups live, that the business (or incoming provider) can reach them, and that a test restore works. Never cut over on faith in backups you've never restored.
4. 4
   Remove their agents and access last

   RMM/monitoring agents, remote-access tools, their engineers' accounts in your tenant, VPN accounts, conditional-access exceptions. This happens after the new provider is fully stood up — a gap in coverage is worse than an overlap.
5. 5
   Rotate what was shared

   Anything from the MSP's password vault that was ever shared outside it — local admin passwords, Wi-Fi, service accounts — gets rotated at cutover.

The contract and conduct notes

• Check the exit clauses before giving notice: data return, handover cooperation, and any offboarding fees. Time your notice so the overlap window is covered.
• Keep it professional and pay the final invoices — withheld payment is the top cause of handover friction, and MSPs talk to each other.
• A provider that resists giving the business its own admin account is answering your due-diligence question for you — that applies to the incoming one too.
• Going forward: the business always holds its own root (tenant admin, registrar, DNS), and every provider — however trusted — works from delegated access you can revoke.