How to switch IT support provider: a checklist

Most organisations stay with an IT provider longer than they should, because the provider seems to hold all the keys. If you want to switch IT support provider without disruption, the work is mostly done before you give notice: confirm what you own, what the contract says, and what you need handed back. This checklist covers all three.

Why switching feels risky, and why it need not be

Over a few years, a provider becomes the place where admin passwords, licence accounts and know-how all sit. That is normal, but it means a badly planned exit can leave you locked out of your own systems. The fix is simple: make sure your organisation owns its accounts and data, and treat the handover as a small project with a plan and dates, not an event.

Before you give notice

Read the contract

Check the notice period, the end date and any exit or handover clauses. The NCSC’s guide to choosing a managed service provider asks whether there is “a clear process for contract review, renewal, or termination”, and whether the contract covers obsolete accounts and infrastructure. If yours is silent, agree the handover steps in writing when you give notice.

Own your Microsoft 365 admin access

At least one Global Administrator account should belong to your organisation, not the provider. Microsoft recommends two cloud-only emergency access accounts, not assigned to any one person and protected with phishing-resistant sign-in, for the day normal admin accounts cannot be used. In the Microsoft 365 admin center, Settings > Partner relationships shows which partners hold admin roles. You can remove those roles at any time. Removing roles does not end a reseller relationship, and Microsoft notes that a partner can still buy on your behalf until it removes that ability in Partner Center, so ask for that too.

Check domains, Apple Business and Jamf

• Your domain names and DNS should be registered in your organisation’s name, with a login you control.
• Your Apple Business account should belong to your organisation, with at least one administrator from your own team.
• If you use Jamf, check whose contract covers the Jamf Pro instance and licences, and which Apple Account created the Apple push certificate. Jamf says that certificate must be renewed every year with the same Apple Account. If it was made with someone’s personal account and they leave, every device has to be re-enrolled.
• Apple’s content tokens for apps and books expire after a year and are tied to the Managed Apple Account that downloaded them. Find out which account that is.

Licences and subscriptions

List every licence your provider supplies: Microsoft 365, security, backup, device management and business apps. Note renewal dates, who the licences are billed through and whether they can be transferred without a gap in service. Plan the switch around those dates.

Your data and the provider’s records

If your provider processes personal data for you, UK GDPR requires your contract with them to say what happens at the end. The ICO’s guidance is clear: at your choice, the provider must delete or return all the personal data it has been processing for you, and delete existing copies unless UK law requires it to keep them. Decide which you want before the last day.

Ask about logs too. The NCSC suggests checking whether logs are kept for security purposes, how long they are kept, and whether you can access them. If you need a record of past sign-ins or alerts, export it before access ends.

Documentation to request

• Network, firewall and Wi-Fi details.
• A list of devices, users and admin accounts.
• Backup configuration, where backups are stored and the date of the last successful restore test.
• Open tickets, known issues and planned changes.
• Contacts for the suppliers of your business apps, broadband and printers.

During the handover

Agree a handover date and, if you can, a short overlap. On day one, the new provider should review every admin account, remove old and shared ones, and confirm multi-factor authentication. The NCSC recommends giving any provider only the access it needs (least privilege) and requiring 2-step verification on its accounts. Tell your people how to get help from the first day of the new service.

After the switch

• Confirm every device is enrolled and reporting to the new provider.
• Check backups are running, then test a restore.
• Confirm the old provider’s partner roles and accounts are gone.
• Book your first service review.

What to agree with your next provider

Use the switch to fix what was vague last time. The NCSC calls a matrix of responsibilities, setting out what the provider does and what you do, good practice. Ask for clear incident reporting, regular reviews and written reporting, so you have a record of what was checked and fixed.

How we help

We run onboarding as a project in four stages: discover, secure, enrol and go live. On average it takes four weeks, and email, files and apps keep working throughout. You keep ownership of your Microsoft 365 tenant, Jamf instance, domains and data. See how switching to us works, including a short readiness check, or read about our managed IT support. Cranbrook Legal moved its IT to us from an internal team that lacked the technical depth it needed.