How to Change IT Provider Without Losing Control

Published: 12 June 2026 · Updated: 6 October 2026

A good IT provider changeover is mostly about control. Who owns the accounts? Who can make changes? What happens if the outgoing provider is slow, defensive or simply disorganised?

You do not need drama. You need a clean plan, proof of ownership and enough information to move without guessing.

Start with ownership, not tickets

Before you move, confirm that your business owns the essentials: domain name, DNS, Microsoft 365 tenant, backup platform, phone numbers, security tools, website hosting, firewall licences and documentation. These should not sit permanently in a supplier account you cannot access.

If a provider set things up years ago and nobody has checked since, this is where awkward surprises tend to appear. Find them before the notice period clock is ticking.

Who actually holds the domain

Your domain is the one asset that controls everything else: email, Microsoft 365, your website, and every password reset that lands in an inbox. Three different things get called “the domain”, and you need to know who holds each:

• The registrant is the legal owner on the domain record. It should be your company, not your IT provider or a former employee.
• The registrar account is where renewals and transfers happen. Your business should be able to log in, with two-step verification switched on and a registrar lock set.
• DNS hosting is where the records live. It is often somewhere else again, and often in the provider’s account.

The NCSC’s guidance on managing public domain names covers this well. If you have .uk domains, note that Nominet is changing how they transfer: from 9 February 2027 transfers move to authorisation codes rather than the old tag system (Nominet). While you’re in there, check your SPF and MX records for anything that still points at the old provider’s services.

Read the exit clauses before you serve notice

Before anyone sends a termination email, read the contract you’re leaving. The details that matter are the notice period, whether the agreement renews automatically if notice isn’t given in time, any charges on exit, and what the provider is obliged to hand back: documentation, credentials, configuration and backup data.

Where the provider processes personal data for you, UK data protection law expects the contract to require it to delete or return that data at the end of the service (ICO). The NCSC’s guide to choosing a managed service provider is also worth a read on exit terms, ideally before you sign the next contract rather than after.

Secure admin access

Your incoming provider will need appropriate access, but that does not mean handing over shared passwords. Create named admin accounts, protect them with strong MFA, document break-glass access and remove access that is no longer needed once the handover is complete.

The business should also have a route back in if the provider relationship fails. That is not mistrust. It is basic governance. Microsoft’s guidance is to keep at least two cloud-only emergency access accounts, protected with phishing-resistant authentication and tested regularly (Microsoft Learn).

Microsoft 365: partner access, licences and Azure

Most providers reach your tenant through a partner relationship rather than a user account, which makes it easy to forget. In the Microsoft 365 admin centre, Settings > Partner relationships shows who has delegated admin rights, and you can remove their roles there (Microsoft Learn). Removing admin roles doesn’t end a reselling relationship, and any Azure subscription access has to be removed separately.

Check how your licences are bought, too. If they come through the outgoing provider as annual subscriptions, they carry a commitment to their renewal date, so plan the licence move around those dates rather than discovering them afterwards.

Map what exists

A sensible transition checks users, devices, servers, cloud services, network equipment, backup jobs, security tools, licences, support contracts and known risks. The goal is not to create paperwork for its own sake. It is to avoid discovering critical systems through outages.

Control the handover

Agree dates, responsibilities, escalation routes and access windows. Keep changes calm during the transition unless there is a clear security issue. If something is already fragile, record it and deal with it deliberately rather than making ten rushed improvements on day one.

What to change on cut-over day

• Remove the outgoing provider’s remote management and backup agents from every device, and their apps from your Microsoft 365 tenant (enterprise app permissions).
• Rotate the passwords they knew: firewall, VPN, service accounts, Wi-Fi and any shared admin logins.
• Re-key local administrator passwords, ideally managed by Windows LAPS so each device has its own.
• Test the break-glass accounts actually work before you need them.
• Confirm backups are running under the new arrangement, and do a test restore.

Stabilise after the move

The first job after takeover is not to sell projects. It is to stabilise the environment, close urgent gaps and give the client a clear picture of what they have. That is where trust starts.

NorthMSP handles provider changeovers with a controlled onboarding process. Read about secure onboarding or speak to us about managed IT support.