When your IT provider leaves: what access and documents do you need?

When your IT provider leaves, you need to be able to reach your systems yourself: Microsoft 365, domain, firewall, backups. This checklist shows which access and documents you need and what to secure first. It helps with an orderly departure just as much as with a sudden loss.

This article covers the documents and access. How to prepare for a new provider and who owns your tenant is covered in the article Changing IT provider.

When your IT provider leaves: with notice or suddenly

In one takeover, I discussed the way forward together with the client and the former IT provider. Where that is possible, I recommend a conversation like this: much of what matters is not written down anywhere.

What to secure first

I start with the access without which other access cannot be recovered. Password resets for other services often run through the domain and email as well.

The order of the first steps

1. Microsoft 365your own administrator account, sign-in tested yourself
2. Domain and DNScustomer account with the registrar, access to the DNS settings
3. Firewall and remote accessadministrator access, and for cloud management the manufacturer account too
4. Backupsaccess to the backup and the date of the last restore
5. Passwordsall credentials in one place that you can access

As soon as your own access has been tested and support has actually been handed over, switch off the previous provider’s accounts. How to do that is described further down.

Checklist: access and documents from your IT provider

Tick off what you have checked yourself. Your progress is saved in this browser only.

What the documentation should contain in detail is listed in the article Changing IT provider.

In takeovers, what I most often find missing is access to the domain and DNS, the passwords for servers and local administrator accounts, the network documentation, an overview of licences and contracts, and access to the router and internet provider.

What matters for each item

Admin accounts and devices

A password alone is not enough. If the second sign-in factor is on the provider’s smartphone, you still cannot get in. The same applies to recovery addresses.

Also check devices with their own manufacturer account. In one takeover, a NAS was still linked to the former provider’s account. I disconnected it, linked it again and set up the notifications afresh.

For Microsoft 365, Microsoft recommends two emergency access accounts and a test at least every 90 days. How to assign roles properly is something I describe under Privileged Identity Management.

Domains and DNS

The holder and the manager of a domain can be different parties, so check both. Also save the DNS records before anything changes. They determine where your email and your website end up.

Licences and contracts

Microsoft 365 licences can run through a partner. That partner then bills for them, even when the support ends. For a direct transfer of a CSP subscription to another partner, the current partner must agree. Clear this up early and in conversation. The same goes for contracts in the provider’s name.

Backups

Do not just have the backup shown to you: restore a file as a test. Also check who receives the error alerts. If the provider’s address goes out of service, a failure goes unnoticed. Microsoft 365 is a topic of its own: Backup for Microsoft 365.

Passwords

In takeovers I usually receive a password list, from former providers often as a KeePass database. It is a start, but not proof: check every important entry by signing in yourself.

Passwords never belong in an email. Store them in a password manager and, after the handover, change all credentials the previous provider knew or managed.

Closing your IT provider’s access

This is part of a normal departure and is not aimed at the person. Work in this order:

1. Test your own access: All important sign-ins work without the provider.
2. Remove accounts: Switch off the provider’s personal accounts, VPN access and remote maintenance.
3. Check partner roles: In the Microsoft 365 admin center, under Settings and Partner relationships, you can see which partners hold roles and remove them. Any existing reseller or billing relationship does not automatically end as a result.
4. Change passwords: Set all passwords anew and store them in the password manager.

When your previous IT provider will not cooperate

1. Write formally: The management requests access and documents in writing.
2. Settle the domain: Through the registrar, with proof that your company is the holder.
3. Reset devices: Only if there is no other way.
4. Document afresh: Everything you find and change.

In one case, client and provider had fallen out, and hardly any information about the environment was forthcoming. Everything had to be pieced together from the client’s memory and old emails. For this I used small tools of my own that, for example, scan the network.

In the office move from my case studies there was only a password list with a handful of logins, no handover and no documentation.

What you should keep in your own hands for good

• the domain, registered to your company
• your own administrator access and documented emergency access accounts, with the credentials stored securely
• a list of all contracts and licences
• up-to-date documentation

Frequently asked questions

How long does this take?

Usually a few days, but it depends heavily on the individual case.

What do I do if my IT provider can no longer be reached?

First look within your company for documents and existing administrator accounts. After that, what remains is a reset or the manufacturer. The graphic in the article Changing IT provider shows the sequence.

Does my IT provider have to hand over access and documents?

That is a legal question and also depends on your contract. Look there first and, if in doubt, ask a lawyer. In practice it helps to send a specific list early on.

How can I tell whether my domain belongs to my company?

For .de domains, the DENIC whois lookup helps. If a legal entity such as a limited company is the holder, it shows the name and address. For natural persons this data is not public.

Sources

• Emergency accounts: Microsoft Learn – Manage emergency access accounts in Microsoft Entra ID (as of October 2026)
• Removing partner roles: Microsoft Learn – Manage Microsoft-certified solution provider partner relationships (as of October 2026)
• Transferring licences between partners: Microsoft Learn – Partner transfers the billing ownership to another CSP partner (as of October 2026)
• Checking the holder of a .de domain: DENIC – Domain query (whois)