How to Switch Managed IT Providers Without Losing Data or Uptime

You can switch managed IT providers without losing data or uptime if you do things in the right order. First, get company-owned control of your admin accounts, domain, cloud tenant, licensing, backups and documentation. Then give notice and run a planned overlap with the new provider. Remove the old provider’s access only after the new one has proven it can run, back up and restore your environment.

Most painful switches happen because a business gives notice first and only then finds out that its domain, its firewall login or its Microsoft 365 licenses sit in the provider’s name. This guide is vendor-neutral. It covers what to secure, which contract clauses to read, how to remove the old provider’s tools and accounts, and a 30/60/90-day plan. It is the same sequence we follow when organizations move to our managed IT services.

Why the order of steps matters

An outgoing provider often holds the keys to everything: the global admin account, the registrar login, the backup console and the password vault. Most providers hand these over professionally, but you want control in hand before a notice letter changes the relationship.

There is also a security reason. A 2022 joint advisory from CISA, the NSA, the FBI and cyber agencies in the UK, Australia and Canada warned that attackers target MSPs to reach their customers. It tells customers to put responsibilities in their contracts and to “disable MSP accounts that are no longer managing infrastructure.” A switch is the moment those leftover accounts get created, so plan to close them.

What to secure before you give notice

Each item on this checklist should end with a company owner (not a technician) holding the login or the file.

• Global admin or super admin accounts. Create two cloud-only emergency admin accounts in Microsoft 365 or Google Workspace, with strong MFA, held by an owner or officer. In Microsoft 365, check Settings > Partner relationships to see which partners hold admin roles, and review the user list for accounts the provider created for its staff.
• Domain registrar. Confirm the domain is registered to your company, with a company email address as the contact, and that you can log in. ICANN’s registrant guidance says your registrar must give you the transfer authorization code within five calendar days of a request. Avoid changing the registrant name mid-switch, because ICANN rules can lock a domain against transfer after a change of registrant.
• DNS hosting. The registrar and the DNS host are often different companies. Export a copy of every DNS record (mail, SPF, DKIM, DMARC, website, verification records). A lost MX or SPF record is the fastest way to break email during a switch.
• Cloud tenant and billing. Your Microsoft 365 or Google Workspace tenant is yours, but the billing account may belong to the provider as reseller. Record who bills you, each subscription, user counts, term end dates and renewal settings.
• Backups. Find out what is backed up, where copies live, whose account holds them, how long they are kept and who controls the encryption keys. If the backup service is licensed to the provider, it leaves with the provider unless you arrange an export or overlap.
• Firewall, switches and Wi-Fi. Get local admin credentials, a configuration export, and the name on the support or security subscription. Ask whether the hardware is owned by you or leased from the provider.
• RMM and security agents. Ask for a list of every remote monitoring and management (RMM), antivirus, EDR and backup agent installed on your devices.
• Documentation and passwords. Request an export of your password vault entries, network diagrams, an asset list with warranty dates, line-of-business application vendor contacts, ISP account numbers and any runbooks.

How licensing transfers (CSP and Google resellers)

Many businesses buy Microsoft 365 through a Cloud Solution Provider (CSP) partner, which is often the same company that manages their IT. Changing who bills you does not require moving mailboxes or files. It is a billing transfer.

Under Microsoft’s documented process for license-based subscriptions, you first accept a relationship request from the new partner. The new partner then creates a transfer request, and the current partner must review and approve it. Microsoft states that requests not acted on expire after 30 days, transfers can take up to 72 hours, and subscription properties such as user counts and renewal settings carry over. The term end date does not change.

Google Workspace works differently. A super administrator starts the transfer in the Admin console under Account > Reseller management, enters the new reseller’s public identifier and generates a transfer authorization. Google says transfers do not affect your data or availability, that they cannot be reversed, and that you cannot transfer to resellers more than twice in a calendar year. Google also notes a new reseller can access your Admin console unless you remove that access.

Check commitment terms before you start. Annual subscriptions usually cannot be cancelled mid-term, so a transfer is often better than cancelling and rebuying.

Contract clauses to read before you give notice

Pull the master services agreement, statements of work and order forms, and write down the dates for each of these terms.

• Notice period and term. How many days of written notice are required, to whom, and in what form? Does the agreement renew automatically?
• Early termination. Are there fees or remaining-term charges? Do hardware leases or financed equipment have separate terms?
• Data return. What data and documentation must the provider return, in what format and by when? Does the clause cover configurations, logs and the password vault, or only “customer data”?
• Transition assistance. Is the provider required to cooperate with a successor? At what rate, and for how long?
• Data deletion. Will the provider delete your data from its systems after the handover and confirm that in writing?
• Ownership. Who owns documentation, scripts and configurations created during the engagement? Which software licenses belong to the provider and will be removed?

The same joint advisory says customer contracts should specify “whether the MSP or the customer owns specific responsibilities” and how the MSP notifies you of incidents. If your current contract is silent on exit terms, put them in the next one. This is general information, not legal advice. Have counsel review termination and data-return terms before you send notice.

Removing the old provider’s remote tools and accounts

Offboarding the old provider is a security task, not a courtesy. Leftover agents and accounts are an open door, and attackers know it. A January 2023 CISA, NSA and MS-ISAC advisory described criminals using legitimate remote management tools, including portable versions that need no installation, to get into victims’ systems. It recommends that organizations audit remote access tools and use application controls to block unauthorized RMM software.

Use this checklist once the new provider has taken over monitoring and backups:

1. In Microsoft 365, go to Settings > Partner relationships, select the old provider and choose Remove roles. Microsoft notes this does not end a reseller relationship, which is handled separately.
2. Delete or disable any user accounts the provider created in your tenant, and remove its staff from admin role assignments.
3. Review enterprise applications, app registrations and API connections the provider set up. Remove ones you cannot tie to a current need.
4. In Google Workspace, remove the outgoing reseller’s Admin console access and review admin role assignments.
5. Uninstall the old RMM, remote-control and security agents, then confirm through software inventory that no device still reports to the old console.
6. On the firewall, remove provider admin accounts, VPN users and any rules allowing management from the provider’s addresses.
7. Rotate passwords the provider knew: service accounts, local admin accounts, Wi-Fi keys, registrar, DNS, ISP and vendor portals.
8. Remove MFA devices or phone numbers registered to the provider’s technicians, and update technical contacts on registrar, ISP and software vendor accounts.

Once the old access is gone, it is a good time to review tenant settings from scratch. Our Microsoft 365 security checklist walks through the settings a new provider should confirm in its first weeks.

A 30/60/90-day transition plan

Timelines vary with size and complexity, but most switches follow this shape. Keep both providers in place during an overlap rather than letting one contract end before the other is ready.

Phase	Main work	Done when
Before notice	Create company-owned admin accounts, confirm registrar and DNS access, export DNS records, review contract terms, list subscriptions and agents	An owner can sign in to every critical system without the provider
Days 1 to 30	Give notice, sign the new agreement, start license transfers, collect documentation and passwords, new provider deploys monitoring and backups alongside the old ones	New provider sees every device and account, and its first backups complete
Days 31 to 60	Run a test restore, move help desk routing to the new provider, fix gaps found in discovery, tell staff how to request support	Restore test passes and staff tickets flow to the new desk
Days 61 to 90	Remove the old provider’s roles, accounts and agents, rotate shared passwords, confirm data deletion in writing, review the first monthly report	No old access remains and the new provider’s reporting is in place

If you are unsure what you have before you start, a quick baseline such as our cyber risk check can surface gaps to raise with either provider.

Red flags during a switch

Watch for warning signs from both the outgoing and the incoming provider.

• The outgoing provider says it “owns” your tenant, domain or documentation, or refuses to create an admin account for you.
• Charges appear for returning data that the contract does not mention.
• Settings, accounts or backups change after you give notice without a ticket or explanation.
• The incoming provider wants your domain registered in its name or wants to be the only global admin.
• The incoming provider plans to remove old tools before its own monitoring and backups are proven.
• Nobody can show you a recent successful restore. Restore testing is a core part of managed backup and disaster recovery, and a switch is the right time to demand proof.
• The new contract has no exit, data-return or transition-assistance terms. You will need them someday.

How Honeybadger Solutions helps

Honeybadger Solutions LLC is a veteran-led cyber and IT firm headquartered in Casa Grande, Arizona. Our managed IT services are delivered remotely by our own team to organizations across the US and internationally, as fully managed, co-managed or project engagements, with 8/5, hybrid or 24/7/365 coverage. The service includes a staffed service desk, Microsoft 365 and Google Workspace administration, endpoint and mobile device management, network administration, identity and access security, managed backup with restore testing, and governance and compliance support.

When you switch to us, onboarding runs in phases (discover, assess, deploy, stabilize, optimize), and we capture your license position and renewal dates during assessment. You keep ownership of your tenant, domain and admin accounts. We integrate with tools you already own where they fit, and we tell you plainly when one does not. Scope and response targets are written into the service agreement, and quotes are written and given before any work starts.

To plan your move, request managed IT services online or book a confidential consultation. If you suspect your current provider’s access has been misused, use our urgent intake form.

Frequently asked questions

How long does it take to switch managed IT providers?

There is no fixed timeline. The 30/60/90-day plan above is a reasonable target for many small and mid-size organizations, including a period where both providers overlap. Size, number of sites, contract notice periods and license terms all change it. Securing admin access and documentation before notice is what keeps it on track.

Will our email go down when we change providers?

It should not. Changing providers does not require moving mailboxes, and a license transfer is a billing change. Outages usually come from DNS mistakes, so export your DNS records first and avoid changing mail records during the handover.

Can we switch before our contract ends?

Often yes, but read the notice period, early termination and renewal terms first. Some businesses give notice at the earliest allowed date and run the new provider in parallel until the old term ends. Have counsel review the terms before you act.

Who should own the global admin account?

Your company should. Keep at least two emergency admin accounts held by owners or officers, protected with strong MFA. Your provider should use its own named, separate admin accounts so every change can be traced to a person.

Do we have to move our licenses to the new provider?

Not always. You can keep buying licenses from the old reseller, buy directly from Microsoft or Google, or transfer them to the new provider. Transferring keeps billing and support in one place, and both Microsoft and Google document a transfer process that does not touch your data.

Sources: Microsoft Learn: Manage partner relationships, Microsoft Learn: Customer-led termination of a GDAP relationship, Microsoft Learn: Transfer new commerce license-based subscriptions between CSP partners, Google Workspace Admin Help: Transfer subscriptions between Google and resellers, ICANN: Domain name registrant FAQs on transfers, Joint advisory: Protecting Against Cyber Threats to Managed Service Providers and their Customers (2022), CISA AA23-025A: Protecting Against Malicious Use of Remote Monitoring and Management Software (2023)