How to Switch IT Providers Without Losing Passwords, Licenses, or Control

Table of Contents

Before telling the incumbent provider anything, establish which assets belong to your company and who can access them. Your business should be the owner or primary account holder wherever the platform allows it. The provider should have delegated administrative access, not personal ownership.

Some services may legitimately be purchased through the outgoing provider. That is fine, but the contract should explain what transfers, what must be replaced, and how long data remains available after termination. A subscription ending is manageable. An unknown subscription ending without warning is not.

Do not cancel service until this inventory exists. Once notice is given, the transition clock starts and goodwill can become unpredictable.

A useful inventory is more than a spreadsheet of device names. It tells the incoming provider what exists, who depends on it, how it is administered, and what would happen if it stopped.

The incoming provider does not need a perfect encyclopedia before starting. It does need enough information to keep critical services running and to identify the gaps that require discovery work.

If the outgoing provider has good documentation, the handoff is faster. If it does not, that is not a reason to stay. It is evidence that the transition needs a deliberate discovery phase.

An IT transition temporarily puts two providers near the same systems. That makes identity and logging more important, not less.

Give each provider separate named accounts. Do not pass around one shared domain administrator password. Require multifactor authentication, limit each account to the systems it needs, and preserve logs showing who changed what. Agree in advance on the exact time the outgoing provider's access will be disabled.

This is not just our preference. CISA's joint guidance for MSPs and their customers recommends least-privilege access, strong authentication, monitoring, logging, and clear contractual responsibility between the provider and customer.

A clean access transition normally looks like this: 1. Create new named accounts for the incoming provider. 2. Verify MFA and emergency access before changing anything else. 3. Export or preserve the logs needed to investigate later problems. 4. Rotate shared passwords, API keys, service-account credentials, and recovery codes. 5. Remove the outgoing provider's access at the agreed cutoff. 6. Audit privileged groups and remote-access tools after the cutoff.

The goal is not to treat the former provider as hostile. The goal is to leave no ambiguous access behind.

Monitoring agents, endpoint protection, backup software, and remote-support tools should not be ripped out all at once. Every old control should remain until its replacement is installed, checked, and reporting correctly.

A safe sequence is:

First, establish visibility. The new provider documents the environment, confirms administrator access, and deploys its monitoring where appropriate.

Then, protect recovery. Verify that backups are completing and perform at least one test restore before altering the old backup platform.

Next, move security controls. Install and validate the replacement endpoint and email-security tools before removing the old agents. Watch carefully for conflicting products during the overlap.

Then, move support. Give employees a clear support number, email address, and go-live date. Tell them what will look different and what will not.

Finally, remove old access and tools. Uninstall abandoned agents, close provider accounts, rotate credentials, and confirm that alerts now reach the right team.

This order keeps the business observable and recoverable throughout the change.

"The backups are working" is not a handoff artifact. A successful restore is.

Keep an independent copy of essential documentation and recovery information outside the systems being transitioned. CISA's risk considerations for MSP customers similarly emphasize offsite backups, activity logs, limited provider privileges, and continuity planning.

If nobody can demonstrate a restore, treat the backup as unverified. Do not discover that distinction during an outage.

The exact timing depends on the environment, but assigning work to phases keeps a transition from becoming an open-ended scavenger hunt.

Days 1-3: control and communication. Confirm decision-makers, critical systems, vendors, support contacts, ownership, and the final date with the outgoing provider.

Days 4-10: access and discovery. Transfer documentation, establish named administrator accounts, inventory systems, preserve logs, and identify missing credentials or unknown dependencies.

Days 11-20: tool deployment and validation. Deploy monitoring, support, backup, and security tools in a controlled order. Test alerts and restore data. Begin resolving the highest-risk findings.

Days 21-30: cutoff and cleanup. Remove old access, rotate secrets, uninstall abandoned agents, reconcile licenses, review open issues, and give leadership a concise environment summary and improvement plan.

Complex migrations can take longer, but basic accountability should not. At the end of the first month, you should know what you own, what remains at risk, and what the new provider is doing next.

Professional providers understand that clients change direction. They may enforce the notice period and invoice correctly, but they transfer client-owned information without theatrics.

The best time to prevent these problems is when signing the original agreement. CISA provides an SMB vendor-assessment resource that includes a managed-service-provider vetting use case. Ownership, security responsibility, incident notification, data return, and transition assistance belong in the contract before the relationship starts.

You should not need to understand every technical detail. You should be able to see who is accountable, what has been verified, what remains unknown, and what happens next.

A good transition is not a dramatic weekend cutover. It is a measured handoff in which access is transferred, protections overlap, backups are verified, and responsibility becomes clearer each week.

If dissatisfaction with your current provider has been outweighed by fear of the move, start with ownership and documentation. You can learn a great deal before giving notice, and none of that work is wasted if you decide to stay.

KaselTech handles the outgoing-provider coordination, account recovery, documentation, tool deployment, and first-month stabilization for managed IT transitions. During August, onboarding and transition are included for qualifying new managed IT agreements, with no long-term contract. Start with the free technology review or talk through the handoff with us.