How to Switch IT Providers Without Losing Access or Data

Most businesses decide to switch IT providers months before they actually do it. The holdup is rarely the contract. It is the worry about what happens if the old provider still holds the keys: the Microsoft 365 admin account, the domain, the firewall, the backups. That worry is reasonable. Verizon’s 2026 Data Breach Investigations Report found a third party involved in 48% of breaches, up 60% from the year before, and your IT provider is the third party with the deepest access to your systems.

This guide covers how to switch IT providers in the right order: what to secure before you give notice, how to plan the Microsoft 365 and domain handoffs, how to run the old and new provider side by side, and how to shut off the old provider’s access once the move is done.

The order matters more than anything else in a switch. Once notice is given, every request you make depends on the goodwill of a provider who is losing your business. Before that conversation happens, check that your company, not the provider, controls each of these.

Read the contract before you write the notice letter

Four clauses decide how smooth the exit will be:

• The notice period and the auto-renewal date, so you do not miss a window and pay for another term.
• Who owns any firewall, switch, server or backup appliance the provider installed.
• What the agreement says about returning documentation, credentials and data at termination.
• Any fees tied to offboarding, data export or early termination.

NIST’s Cybersecurity Framework 2.0 treats this as its own control: supply chain risk plans should include provisions for what happens after a relationship ends (GV.SC-10).

Most providers manage Microsoft 365 through Microsoft’s partner program, using granular delegated admin privileges (GDAP). That access does not end when your contract does. Microsoft lets a provider set a GDAP relationship to extend automatically by six months at a time, so an old relationship can stay active long after you have moved on unless someone removes it. Microsoft does not allow automatic extension for relationships that include the Global Administrator role, but other relationships can roll forward indefinitely.

Removing it is quick. A Global Administrator signs in to the Microsoft 365 admin center, opens Settings and then Partner relationships, selects the old provider and chooses Remove roles. Do this at the end of the transition, once the new provider has its own access. Microsoft’s documentation also notes that this does not touch Azure: if the old provider holds role assignments on an Azure subscription, those have to be removed separately.

Move licenses as a partner transfer, not a cancellation

Licenses are a separate step from admin access. When your new provider becomes your Microsoft licensing partner, the subscriptions move across instead of being cancelled. According to Microsoft’s current documentation, updated in May 2026, the term and renewal date carry over, each subscription receives a new ID, the transfer can take up to 72 hours, and a transfer request expires if no one acts on it within 30 days. Anything that references the old subscription ID, such as billing reports or scripts, will need updating.

If your domain is registered in the provider’s name or sits inside the provider’s registrar account, two things need to change: the registrant, meaning the legal owner on record, and the account the domain lives in. Under ICANN’s current Transfer Policy, changing the registrant triggers a 60-day lock on moving the domain to another registrar. Registrars may let you opt out of that lock, but only before the change is made. Registrars can also refuse a transfer within 60 days of a domain’s creation or its last transfer.

ICANN’s board took up a package of transfer-policy changes in June 2026 that would remove the change-of-registrant lock and set a 30-day restriction after registration or transfer instead. No effective date has been announced, so plan around the 60-day rule for now.

In practice: get the registrant corrected to your company first, ask the registrar about the opt-out before anything changes, and leave any registrar transfer for later. Moving DNS hosting does not require transferring the domain, so it rarely holds up the rest of the switch.

Ask three questions in writing: where every backup copy lives, whose account it sits in, and what happens to it on the day the contract ends. Some providers keep backups for a set period after termination. Others delete them when the service is cancelled. You want the answer before notice, not after.

Your new provider should have its own backups running and tested before the old ones are retired, so there is never a day with nothing to restore from. If you rely on Microsoft 365 for email and files, confirm what is backed up there too; Microsoft’s built-in retention is not the same thing as a backup, which we cover in our guide to Microsoft 365 backup for business.

HIPAA practices have a contract obligation too

A business associate agreement must require the provider, at termination, to return or destroy the protected health information it still holds and keep no copies. If return or destruction is not feasible, the agreement’s protections have to extend to whatever remains (45 CFR 164.504(e)(2)(ii)(J)). Ask for written confirmation of which one happened.

The safest switches overlap. The new provider deploys its monitoring agents and endpoint protection while the old provider’s tools are still running, confirms every device is reporting, and only then are the old tools removed. Systems move one at a time in an order you approve, so your team keeps working while the change happens around them.

At On-Site Technology this is a 30-day parallel transition. Our monitoring runs on Datto RMM, endpoint protection runs on SentinelOne and/or Microsoft Defender for Business depending on the layers your environment needs, and both come online system by system while your current provider winds down. You can open tickets in our client portal from day one. There is no onboarding or transition fee; it is built into the monthly managed IT services agreement. If you have in-house IT staff you want to keep, the same process applies to a co-managed IT arrangement.

A realistic timeline for switching IT providers

Larger environments, regulated industries and multi-site businesses usually take longer. A domain caught in the 60-day lock can run past the rest of the project, which is one more reason to start with the registrant.

This is the step most switches skip, and in 2026 it is the one attackers look for. Every remote access tool the old provider installed is still a door into your network until someone removes it. Huntress reported that abuse of legitimate remote monitoring and management (RMM) tools rose 277% year over year in 2025, accounting for 24% of the incidents it observed. In the first quarter of 2026, attackers used legitimate RMM software in 45% of the endpoint incidents Huntress recorded. A forgotten agent from your previous provider looks exactly like routine IT activity.

Work through this list before you call the switch finished:

1. 1
   Uninstall the old provider’s RMM and remote access agents from every workstation and server, then run an inventory scan to prove none remain.
2. 2
   Remove the old provider’s partner roles in the Microsoft 365 admin center, along with any Azure role assignments.
3. 3
   Disable the user accounts the provider created for itself in Microsoft 365, on servers, on the firewall and inside business applications.
4. 4
   Change every shared password the old provider knew, starting with admin accounts, the firewall and Wi-Fi.
5. 5
   Delete the provider’s VPN accounts and any firewall rules that existed only for their remote access.
6. 6
   Collect written confirmation of what happened to your backups and data.

CISA’s Cybersecurity Performance Goals 2.0, released in December 2025, added a goal aimed at third-party providers with deep system access, including managed service providers. Removing a departed provider’s access is the most basic form of that control, and it is free. If you want an outside view of where your environment stands before or after a switch, our free cybersecurity risk assessment takes a few minutes.

When the old provider won’t cooperate

Most handoffs are professional. Some are not: credentials go missing, the registrar account turns out to be in someone’s personal name, or requests go unanswered until the contract runs out. Waiting it out only extends the time the old provider can still reach your systems. Microsoft, domain registrars and software vendors can restore access when your company can prove it owns the account, and the process moves faster when someone who has done it before assembles that proof. On-Site Technology helps clients recover admin access from uncooperative providers as part of onboarding, so a switch does not stall on someone else’s response time.

If you are still deciding whether it is time to leave, our guide to choosing IT support companies for small business covers the signs and how to compare providers.