Switching IT providers is mostly an access problem, not a technical one. Before you give notice, confirm you control four things: your domain name and DNS, your Microsoft 365 tenant and at least one Global Administrator account in your own name, the licences billed to your business, and backups you can restore without the outgoing provider’s tools. If those four are yours, a handover is a scheduled four- to eight-week project with no downtime. If any of them aren’t, fixing that is the first job.
The rest is sequence. Read the exit terms before you start conversations, collect documentation while the outgoing provider still has a reason to help, overlap the two providers rather than cutting over on a Friday, and rotate every credential that changed hands. This guide covers the signs it’s time, what you own, notice periods, a handover checklist, the security steps when access changes hands, what good onboarding looks like, and a realistic timeline.
Signs it’s time to change providers
One bad month isn’t a reason. A pattern is. The signs that usually matter:
- The same problems keep coming back, and nobody has explained the underlying cause.
- There is no documentation — no network diagram, no asset list, no record of what changed when.
- You can’t get a plain list of what you pay for each month, or the invoice is one line.
- Nobody has raised planning or budget with you in a year. Every conversation is reactive.
- Security basics are missing or unverified: multifactor authentication isn’t enforced, patching isn’t reported, and nobody has tested a restore.
- Requests for administrator access to your own systems are met with reluctance.
- Response times have quietly drifted, and there’s no agreed target to point at.
- The business has changed — new sites, remote staff, compliance obligations — and the service hasn’t.
What you own, and must get back
Everything below should already be in your business’s name. Verify each one yourself, by logging in, rather than accepting an assurance.
| Asset | Why it’s yours | What to ask for |
|---|---|---|
| Domain name | CIRA’s rules treat the Registrant as the party a .ca registration is associated with, and a Registrant changes registrar by first obtaining the authorization code from the current Registrar of Record | Registrar account login, the Registrant contact showing your business, and the authorization code |
| DNS | Your records control where email and your website resolve | A full export of the zone, and access to wherever it’s hosted |
| Microsoft 365 tenant | The tenant is yours; a partner’s access to it is delegated and removable by you | A Global Administrator account in your name, and a list of every account holding admin roles |
| Licences | Subscriptions bought through a partner can be transferred to another partner, or billed directly | A list of every subscription, its term, renewal date and who it’s billed through |
| Documentation | It describes your systems, and it’s what the next provider needs on day one | Network diagram, IP plan, asset and warranty list, vendor and account list, change history |
| Backups | The data is yours regardless of whose software wrote it | Where copies live, retention, encryption keys, and a restore tested in front of you |
| Firewall, VPN and Wi-Fi | You paid for the hardware and the subscriptions on it | Admin credentials, a current configuration export, and licence renewal dates |
| Line-of-business applications | Your contracts with those vendors | Vendor contacts, support contract numbers in your name, and admin credentials |
Notice periods and contract exits
Find the signed agreement before you do anything else, and read for these points.
- Term and renewal. When does it end, and does it renew automatically? An auto-renewal that passes while you’re shortlisting can cost you another year.
- Notice period and method. Thirty, sixty or ninety days is common. Some agreements require written notice delivered a particular way; a Teams message to your account manager may not count.
- Early termination. Fees, and any unamortized equipment or onboarding costs you agreed to repay.
- Prepaid amounts. Block-hour balances and annual licences paid in advance. Ask for a final statement showing both.
- Handover obligations. What the agreement says about returning documentation, administrator access and data, and whether transition assistance is included or billable. If it’s billable, agree the rate and a cap in advance.
There’s a privacy dimension as well. Under B.C.’s Personal Information Protection Act, an organization is responsible for personal information under its control and must make reasonable security arrangements to protect it, and must destroy documents containing personal information once the purpose has been served and retention is no longer necessary. Ask the outgoing provider, in writing, what personal information about your staff and clients they hold, where it is, and what happens to it after the last day.
Keep the tone businesslike. Most handovers go fine, and a cooperative outgoing provider saves you real money in discovery. Pay the final invoice on time.
The handover checklist
Request this pack in writing, with a due date
- Administrator credentials for every system: servers, hypervisors, NAS, firewall, switches, Wi-Fi controller, printers and line-of-business applications.
- Domain registrar login, the Registrant record showing your business, and the authorization code if the domain is moving registrar.
- A full DNS zone export, including MX, SPF, DKIM, DMARC and any verification records.
- A Global Administrator account in your Microsoft 365 tenant, plus a list of every account holding an admin role.
- A list of all subscriptions and licences: product, quantity, term, renewal date and who they're billed through.
- Network diagram, IP addressing plan and VLAN layout.
- Asset list with serial numbers, purchase dates and warranty expiry.
- Firewall and VPN configuration exports, plus any pre-shared keys and certificate details.
- Backup details: what's protected, where copies live, retention, encryption keys, and a restore demonstrated end to end.
- Vendor and account list: internet, phones, hosting, SSL certificates, cloud services, with account numbers and contacts.
- Open tickets, known issues and anything deliberately left unfixed.
- Change history or documentation platform export for the last twelve months.
- A final invoice and statement, including any block-hour balance.
Give the incoming provider this list too. A good one will already have their own version, and will tell you which items they can rebuild themselves if the pack comes back incomplete.
Security steps when access changes hands
Microsoft’s own guidance on emergency access accounts says to revalidate them when there’s a recent change in IT staff, such as after a termination or position change. The same reasoning applies when the IT staff are outsourced: a provider change is an access event, and it deserves the same treatment as an employee departure.
Work through it in this order.
- Inventory privilege before anything changes. Every account with administrator rights: Microsoft 365 and Entra roles, local administrators, firewall and network devices, hypervisors, NAS, application admins, service accounts, shared mailboxes and any third-party portal. Save the list — it’s what you compare against in thirty days.
- Establish your own access first. Create a Global Administrator account in your name, and two cloud-only emergency access accounts. Microsoft recommends these use the onmicrosoft.com domain, are not tied to any individual, use phishing-resistant sign-in such as a passkey or certificate, are excluded from Conditional Access policies that would block sign-in, and have their credentials stored securely in separate locations.
- On the last day, remove delegated access. In the Microsoft 365 admin centre, the Partner relationships page lets you remove a partner’s granular delegated admin roles yourself. Do the equivalent in every other portal: remote monitoring, security consoles, backup, and any vendor portal where the provider was listed as an authorized contact.
- Disable named accounts, don’t delete them. Disabled is reversible on the Monday when something turns out to depend on a service account. Set a calendar reminder to delete after thirty to sixty days.
- Rotate everything that was shared. Shared and service account passwords, firewall and Wi-Fi administrator passwords, VPN pre-shared keys, hypervisor and NAS credentials, registrar and DNS logins, application admin passwords, API keys, and anything that lived in the outgoing provider’s password vault. Assume a copy exists somewhere.
- Clear stale authentication artefacts. Remove multifactor registrations and app passwords tied to the outgoing provider’s phones and tokens, revoke active sessions, and remove their devices from your device management.
- Reduce to the recommended numbers. Microsoft advises fewer than five Global Administrators and fewer than ten privileged role assignments overall, cloud-native accounts for Entra roles rather than synced ones, and multifactor authentication on every administrator account.
- Apply the baseline. The Canadian Centre for Cyber Security’s baseline controls say to restrict administrator privileges to an as-required basis, keep administrator accounts for administrative work only rather than email and browsing, and require two-factor authentication for system and cloud administrators.
- Turn on the lights. Confirm audit logging is enabled and that someone is alerted when an emergency access account signs in. Review the privilege inventory again after thirty days.
Our small business cybersecurity checklist covers the controls that should be in place once the dust settles.
What a well-run onboarding looks like
Onboarding is where you find out what you bought. A provider who does it properly will do most of this without being asked.
- Discovery before promises. They document your systems first and tell you what they found, including the awkward parts.
- A written transition plan. Dates, owners and dependencies, with the last day of the old agreement marked on it.
- Overlap, not cutover. Their monitoring, endpoint security and backup run alongside the old tools and are verified working before anything is removed.
- A tested restore. Not a green dashboard — an actual file and an actual mailbox recovered in front of you.
- A findings list with prices attached. Clearly split between what onboarding covers and what needs a separate project, so there are no surprise invoices in month two.
- Named contacts and an escalation path. Who you call, and what happens when the first answer isn’t working.
- A thirty-day review. Ticket volumes, what’s been closed out, and what’s next.
Ask what onboarding costs and what it includes before you sign. Published approaches vary from a fixed fee quoted after an assessment to a charge equal to one month of service. Our guide to managed IT services cost covers what to check in the quote.
A realistic timeline
| When | What happens |
|---|---|
| Weeks -8 to -6 | Read the agreement, note the renewal and notice dates, shortlist providers, verify ownership of domain, tenant, licences and backups |
| Weeks -6 to -5 | Compare quotes on the same facts, choose, agree onboarding scope and price, sign |
| Week -5 or per the contract | Give written notice the way the agreement requires, request the handover pack with a due date, confirm the last day |
| Weeks -4 to -1 | Discovery and documentation with the incoming provider; their tools deployed alongside the existing ones; licence transfers started |
| Week 0 | Delegated partner access removed, credentials rotated, old admin accounts disabled, old agents removed, final statement settled |
| Weeks +1 to +4 | Findings worked through, restore tested, privilege inventory reviewed, thirty-day review held, disabled accounts deleted |
Build in slack for licence transfers. When Microsoft 365 subscriptions move between partners, you accept a relationship request with the incoming partner, both partners have to act on the transfer request, an unactioned request expires after thirty days, and transfers take up to seventy-two hours to complete. Nothing about that is difficult, but it isn’t same-day.
How to avoid doing this again in two years
The habits that make the next transition easy are the same ones that make the relationship work.
Keep these current, in your own files
- A one-page ownership record: registrar, DNS host, Microsoft 365 tenant, licence subscriptions and who each is billed to. Review it once a year.
- Your own Global Administrator account and two emergency access accounts, with credentials you control and a quarterly check that they work.
- Documentation as a contractual deliverable, refreshed at least annually and given to you in a readable format.
- A recurring planning conversation — quarterly or half-yearly — with a written summary.
- An itemised monthly statement you can read without help.
- An annual review of who holds administrator access to what, and removal of anything unused.
- A restore test on a set date each year, with the result written down.
It also helps to know what you should be paying. Our guides to managed IT services cost and hourly IT support rates in Vancouver set out published Canadian pricing and what sits behind it.
YVR Technology provides managed IT services, IT consulting and cybersecurity for small and medium businesses across Greater Vancouver and the Fraser Valley, including Vancouver, Surrey and Coquitlam. If you’d like the handover planned before you give notice, get in touch.