You are changing IT providers. What has to be in your hands before you give notice?

Step 1: List what the provider holds

Before you give notice, write down every system where the provider’s name or staff are on the account. Typical items are your Microsoft 365 account roles, the domain name registration, the router and Wi-Fi equipment, the backup account, and the billing for your licenses. Ask the provider for their own list as well, and compare the two.

Mark each item with the name of the person who could reach it today, and the name of a second person. Items with one name, or with a name that is not yours, go first in the steps below.

Step 2: Take control of your domain name

1. Find your registrar at lookup.icann.org, and check that the registered name holder is your company and a person you can reach.
2. If the registrant details need correcting, correct them first, but know the rule: ICANN says you cannot transfer a domain to a different registrar in the 60 days after changing the registrant name, organization, or email address. If you intend to move registrars, ask about doing the transfer before changing contact details.
3. Ask the current registrar to unlock the domain and give you the authorization code. ICANN says the registrar must give you the code within five calendar days of your request.
4. ICANN notes that a registrar may charge a fee, and may not refuse a transfer because the fee is unpaid.

Step 3: Remove the provider’s roles, after you have your own administrators

Microsoft’s roles page says that only Global Administrators can view and manage subscriptions purchased through a partner. Before removing your provider’s access, confirm that at least two people at your company are Global Administrators, as described on the page about who holds the administrator passwords.

1. In the Microsoft 365 admin center, open Settings, then Partner relationships.
2. Select the provider’s row. A provider with full delegated access shows Global Administrator in the Roles column.
3. Select Remove roles, then Yes. Microsoft notes that, with the role removed, the partner can still make purchases on your behalf until they remove that ability on their side. Ask the provider to do that, and ask them in writing.
4. If the transition needs a few more weeks of help, Microsoft suggests creating an account with lower privileges for the partner rather than keeping full access.

Step 4: Disable the provider’s own accounts

CISA’s advisory for customers of managed service providers says plainly that customers should be sure to disable provider accounts that are no longer managing infrastructure, and warns that disabling them can be overlooked when a contract ends. Check user lists in Microsoft 365, any remote access tool, and the network equipment for names that belong to the provider. Disable each one on the day the new arrangement starts, and write down the date.

Step 5: Confirm who owns the backups

Ask whose name is on the backup account, and who holds the copies when the agreement ends. Ask for a copy of your data before the old provider’s access ends. Do not cancel the old backup until the new one has run and you have seen it restore a file.

Also ask for the encryption key if the backups are encrypted. A copy you cannot open is a copy you do not have.

What this order cannot do

It cannot tell you about accounts you did not know existed, such as a vendor portal opened in the provider’s name. A new provider, or we, can read the roles and records with you, and tell you what we found and what we did not, with dates.

Access is easy to hand over on the day and hard to get back afterward.

Related

• Who Holds Your Administrator Passwords: Six Places to Look
• Questions to Ask Your IT Provider About Backups
• When Your IT Person Is Away: Where Alerts and Access Go
• What a Second Opinion on Your Security Covers

Sources

• ICANN: FAQs for Registrants: Transferring Your Domain Name
• Microsoft Learn: Review cloud solution provider (partner) admin privileges
• Microsoft Learn: Customer-Led Removal of a Granular Admin Relationship
• Microsoft Learn: About administrator roles in the Microsoft 365 admin center
• CISA: Protecting Against Cyber Threats to Managed Service Providers and their Customers (AA22-131A)