How to Switch IT Providers Without Losing Access, Data, or a Workday

You can switch IT providers without downtime if you do it in the right order: secure your own admin access first, confirm your backups restore, collect the documentation your new provider needs, run a short overlap, and only then end the old contract. For most small businesses the whole move takes about 30 days. The two places it goes wrong are almost always the same: the outgoing provider holds passwords nobody else has, or the backups everyone assumed were running turn out not to restore.

When is it time to switch IT providers?

It is time when the problems are about how your provider works, not about one bad week. Tickets sit for days. The same issue comes back every month. You find out about outages from your staff instead of from your IT company. Nobody can tell you when your backups were last tested, or which of your laptops are encrypted. Your cyber insurance renewal asks questions your provider can't answer. Or you have grown, and the person who set everything up years ago is still the only one who knows how it works. One of those is a conversation with your provider. Several at once usually means it is time to move.

Read the signs your business has outgrown its current IT setup.

How long does it take to switch managed IT providers?

Plan on about four weeks for a business with up to 50 users and a typical setup: Microsoft 365, a file server or SharePoint, a firewall, and a line-of-business application or two. The first week is discovery and access. The second and third weeks are when the new provider installs its monitoring and security tools, documents your systems, and takes over the help desk. The last week is the overlap, where both providers are watching while you confirm nothing was missed. A business with several offices, on-premises servers, or a compliance requirement such as HIPAA may need longer, mostly because there is more to document.

What should you do before you tell your current provider?

Read your agreement before anything else. Look for the notice period, any early termination fee, who owns the hardware and software licenses, and what the provider has committed to do when you leave. Many small business agreements run month to month or need 30 to 90 days of notice. Then make an inventory you control: every computer, server, and network device, every software subscription, and every vendor account, such as your internet provider, phone system, domain registrar, and line-of-business software. You do not need it to be perfect. You need it to exist somewhere other than your outgoing provider's tools.

See what a managed services agreement should say about leaving.

How do you get your admin passwords back from an old IT provider?

Ask for them in writing and confirm each one works before the provider steps away. The accounts that matter most are the global administrator for Microsoft 365 or Google Workspace, your domain registrar and DNS host, your firewall and wireless controllers, any server or hypervisor administrator accounts, your backup console, and the admin login for each line-of-business application. The safest pattern is to create a new administrator account owned by your business, sign in with it, and then have the old provider's accounts removed. Do not accept a spreadsheet of passwords that nobody has tested. And never let the only copy of your domain registration sit in someone else's account, because losing the domain means losing your email and website together.

CISA's guidance for customers of managed service providers makes the same point from the security side: limit what a provider's accounts can reach, and know exactly which accounts a provider holds in your environment. A transition is the cleanest moment you will ever have to get that list right.

CISA published risk considerations for customers of managed service providers.

How do you make sure your backups survive the switch?

Find out where every backup actually lives and who owns the account it lives in. Backups often sit in a cloud service registered to the outgoing provider, which means they can disappear on the day the contract ends. Ask for a list of what is backed up, how often, and where the copies are kept. Then run a test restore of something real, such as a folder from your file server or a mailbox, before the old provider leaves. Keep the old backups until the new system has built up its own history, usually 30 to 90 days. If you use Microsoft 365, check whether anyone was backing it up at all. Microsoft keeps your data available, but it is not a backup you can roll back to after ransomware or an accidental deletion.

Read what Microsoft 365 backup does and does not protect.

What documentation should your old IT provider hand over?

Ask for a network diagram, the list of IP addresses and any static assignments, firewall and VPN configuration, wireless settings, the server and computer inventory with warranty dates, software license keys and renewal dates, DNS records, backup configuration, and notes on any custom setups such as printer mappings or scheduled tasks. Ask for open tickets and known problems too. A good provider will have most of this ready. A provider that cannot produce it has told you something about how well your systems were being managed. Either way, your new provider will rebuild what is missing during onboarding, but it takes longer and costs more when the outgoing team does not cooperate.

How does the handover week work?

The new provider installs its monitoring and security agent on every device, takes over the help desk number and email, and starts closing the documentation gaps. During that time, both providers have visibility, so nothing goes unwatched. Change one thing at a time rather than everything at once: support first, then monitoring, then security tools, then any larger projects such as replacing a firewall. Name one person on your side to approve changes and keep staff informed about who to call. Then tell your team the day the new help desk goes live, how to reach it, and what will look different on their computers.

What should you change on the day the old provider leaves?

Remove every account the old provider used, and confirm it with a sign-in report rather than a promise. Uninstall their remote access and monitoring tools from every device, because an abandoned remote access agent is an open door. Rotate the passwords for any shared or service accounts they knew. Update your domain, DNS, and vendor accounts so the contact email belongs to your business. Then move the contract end date only after your new provider confirms it has full control. CISA's advisory on threats to managed service providers is a useful reminder of why: attackers target provider tools because one compromised provider can reach many customers.

CISA describes how attackers target managed service providers and their customers.

How do you choose the next provider so you do not have to switch again?

Ask how they onboard a new client, and ask to see the checklist. Ask who will answer when your staff call, what their response times are in writing, and how they report on backups, patching, and security each month. Ask what is included in the monthly fee and what is billed as a project. Ask how they would hand you back your systems if you ever left, because a provider that answers that clearly is one that is not relying on lock-in. And ask to speak with a client of similar size. A short paid assessment before you sign is a good way to see how a provider works before you commit.

See how bdManagedIT onboards a new managed IT client.

Compare the cost of in-house IT against a managed provider.

Book an IT assessment before you switch.