In this guide · 8 sections
- 01Before you give notice: what to secure first
- 02Microsoft 365: partner roles, reseller and licences
- 03Google Workspace: resellers and admin access
- 04Devices: agents, remote access and antivirus
- 05Documentation and backups to collect
- 06The overlap period and cut-over day
- 07Do it yourself or get help?
- 08Frequently asked questions
Short answer
First get your own admin accounts and passwords for everything, then plan an overlap of a few weeks. Move licences and backups to accounts you control, remove the old provider's partner admin roles and remote tools, and collect written documentation before their contract ends.
Before you give notice: what to secure first
Read your current contract for the notice period, handover obligations and who owns what. Our IT support contract checklist lists the clauses that matter. Then, before announcing the change, quietly make sure the business can log in to its own systems.
Secure these before anything else
If any of these are missing, ask for them now as part of normal housekeeping. Our guide to admin account best practice explains how to set up a break-glass admin that no provider controls.
Microsoft 365: partner roles, reseller and licences
Many IT providers resell Microsoft 365 and hold admin rights through Microsoft's partner programme. Microsoft's guide to reviewing partner admin privileges explains how to check:
Open Settings > Partner relationships
In the Microsoft 365 admin centre, see which partners you have and whether they hold admin roles, such as Global Administrator through delegated admin privileges.
Plan the licence move with the new provider
If the old provider bills your licences, the new one or Microsoft direct needs new subscriptions in place before the old ones end. Microsoft notes that new-commerce subscriptions generally can't be cancelled outside a 7-day window, so time it with renewal dates.
Remove the old partner's roles
Select the partner and choose Remove roles. Microsoft points out that removing roles does not stop the partner from making purchases for you; ask them to end the reseller relationship in Partner Center.
Check for leftover named admin accounts
Providers sometimes create accounts like itadmin@ in your tenant. Review all admin roles and remove or reset any you don't own.
Google Workspace: resellers and admin access
Google's help on transferring subscriptions between Google and resellers explains the options: you can move a paid subscription from one reseller to another, or to Google directly. Key points from that page:
- Transfers don't affect your data or availability; staff keep working.
- Transfers can't be reversed, so agree the new arrangement first.
- Subscriptions in the same product group must move together.
- If the transfer date isn't the first of the month, you get two bills that month.
After the transfer, check the Admin console's admin roles and remove any super admin accounts belonging to the old provider, and change the reseller's access to your Admin console if it is still listed.
Devices: agents, remote access and antivirus
IT providers usually install software on every computer: a remote monitoring and management (RMM) agent, a remote control tool, and often their own licensed antivirus or endpoint detection. Each one gives the old provider continued access, or leaves you unprotected when removed.
| Software | Risk if left behind | Order of change |
|---|---|---|
| RMM agent | Old provider can still run commands on your PCs | Remove after the new RMM is installed |
| Remote access tool | Unattended access by people you no longer pay | Remove early, during overlap |
| Antivirus or EDR | Devices unprotected if removed first | Install new protection, then remove old |
| Device management (Intune, etc.) | Policies and encryption keys held elsewhere | Confirm the tenant is yours; recover keys |
| Backup agent | Backups stop or stay in their account | Start new backups before stopping old |
Documentation and backups to collect
Ask for these in writing, with a date. A good provider will have most of it ready.
- Network diagram, IP ranges, firewall rules and Wi-Fi details
- Asset list: computers, phones, printers, serial numbers, warranty dates (also evidence for CSA's Cyber Essentials mark)
- Licence list: what you pay for, renewal dates, and in whose name each account is
- Admin credentials for every system, handed over through a password manager, not email
- Backup inventory: what is backed up, where, retention, and how to restore
- Open tickets and known issues
- Any scripts, scheduled tasks or automations they set up
Backups deserve special attention. If backups sit in the provider's cloud account, agree how long they will keep them after the contract ends, or export them. Start the new backup system first, so there is never a day with no backup.
The overlap period and cut-over day
Paying both providers for two to four weeks is usually cheaper than a gap. During the overlap the new provider installs its tools and documents everything, while the old one is still available to answer questions.
Week 1: access and audit
New provider receives admin access, reviews the environment and confirms the documentation is complete.
Week 2: install new tools
New monitoring, protection and backup are deployed alongside the old ones and confirmed working.
Week 3: remove old access
Old partner roles, agents, remote tools and admin accounts removed. Passwords they knew are changed.
Cut-over: confirm and close
Test sign-in, email, backups and a restore. Confirm the old provider's billing and reseller relationships have ended.
If you are still choosing who to move to, our guide on how to choose IT support in Singapore covers what to ask.
Do it yourself or get help?
A business with a capable office manager can run the admin side: collect logins, check partner relationships and chase documentation. Removing agents and moving protection and backups is best done by the incoming provider.
Our Security Health Check (S$290) reviews your domain, email and Microsoft 365 or Google Workspace settings, including admin roles, and gives a ranked fix list, which is a useful baseline at handover. For ongoing care, Protect Standard (S$19 per user a month) looks after antivirus, devices, the password manager and monthly awareness, with vendor licence fees paid directly by you.
Frequently asked questions
Your contract decides what they must hand over, but the accounts and data in your Microsoft 365 or Google Workspace tenant belong to your business. If they hold the only admin account, Microsoft and Google have ownership verification processes. Avoid that situation by keeping your own admin login from the start.
Not if the change is planned. Moving the Microsoft or Google subscription between resellers does not move or interrupt your data; Google says transfers don't affect availability. Problems come from cancelled licences, changed DNS records or deleted admin accounts, which an overlap period and a written checklist prevent.
In the Microsoft 365 admin centre, go to Settings > Partner relationships to see partners and any admin roles they hold, and remove the roles there. Also check Active users and Roles for named admin accounts the provider created, and ask them to end the reseller relationship in Partner Center.
Two to four weeks suits most small businesses. That gives time for the new provider to install monitoring, protection and backups, confirm they work, and collect documentation while the old provider can still answer questions. Align the end of the overlap with licence and contract dates.
Usually not. The new provider installs its own tools and the old agents are removed. Reinstalls are only needed if old protection software is locked with an uninstall password nobody can supply, or if devices were never properly managed. Ask the outgoing provider to release devices from their consoles during the overlap.