Switching IT providers is rarely hard because of technology. It is hard because the outgoing provider usually holds the keys: admin passwords, Microsoft 365 partner roles, remote-management agents, the domain registrar login, and the only copy of the network documentation. A good transition is a controlled handover of that access. A bad one is a weekend outage or a former vendor who can still log in six months later.

This guide gives you a phased plan, a printable checklist, Texas-specific legal considerations, and what to do when the old provider won’t cooperate.

What Switching Managed IT Providers Actually Involves

Switching managed IT providers means transferring operational responsibility and privileged access for your systems from one managed service provider (MSP) to another, without losing data, security coverage, or service. An MSP is a company that remotely manages your IT under a contract, usually including help desk, monitoring, patching, backup, and security.

In practice, a switch has four parallel workstreams:

Contract: ending the old agreement cleanly and starting the new one.
Knowledge: moving documentation, network diagrams, and system history.
Access: moving and then revoking every credential, agent, and admin role.
Tooling: removing the old provider’s monitoring, backup, and security software and installing the new provider’s.

Most problems come from doing these out of order, for example, removing old tools before new ones are running.

Why an MSP exit is a security event

An MSP holds privileged, often unmonitored access to your whole environment, so the handover period is when that access is most likely to be lost track of. That is why the exit deserves the same care as onboarding.

The evidence is strong:

In 2022, CISA, the NSA, the FBI and cyber agencies in the UK, Australia, Canada and New Zealand published a joint advisory on threats to MSPs and their customers (AA22-131A). It advises customers to make sure contracts state clearly who owns which security responsibilities.
Verizon’s 2026 Data Breach Investigations Report found third-party involvement in 48% of breaches, up from 30% the year before. It also found that only 23% of third parties fully fixed missing or weak MFA on cloud accounts.
IBM’s 2025 Cost of a Data Breach report put the average US breach at $10.22 million, a record high.
NIST’s Cybersecurity Framework 2.0 includes an outcome (GV.SC-10) specifically for activities after a supplier relationship ends, such as ending access and handling data.

What this means for you: treat “remove the old MSP’s access” as a tracked task with an owner and a date, not an assumption.

Signs It’s Time to Change Your MSP (and When to Wait)

Change your MSP when problems are structural, such as repeat outages, slow response, missing documentation, or weak security, rather than a single bad week. Structural problems rarely improve after a complaint.

Signals that usually justify a switch:

The same issues recur, and tickets close without a root cause.
Response times regularly miss the contract’s service levels.
You cannot get a current asset list, network diagram, or admin-account list on request.
Former employees still have active accounts weeks after leaving.
Your cyber insurance renewal asks about MFA, EDR, or tested backups, and the MSP cannot provide evidence.
The provider has outgrown you, or you have outgrown them (for example, you now need HIPAA or CMMC support).

When to wait or fix first:

You are mid-project (an office move, ERP launch, or server migration). Finish it, or pause it, before changing providers.
Your contract auto-renews in the next 30 days, and termination would trigger large fees. Negotiate first.
The real issue is a missing internal owner for IT decisions. A new MSP will not fix that.

How Long an MSP Transition Takes

Most transitions take 4–12 weeks of active work after the new contract is signed, plus whatever notice period your current contract requires. Notice periods of 30–90 days are common, so the calendar time from decision to finish is often 2–5 months.

These ranges are practitioner estimates, not survey data. Competitor guides cite similar figures (30–90 days end to end, or 4–8 weeks for the work), and complexity is what moves you within the range.

Environment	Typical active transition	What drives the time
Under 25 users, cloud-first (Microsoft 365, SaaS apps)	3–5 weeks	Credential collection, agent swap
25–150 users, some on-premises servers	6–10 weeks	Backups, firewall, line-of-business apps
Regulated or multi-site (healthcare, finance, defense contractors)	10–16 weeks	Compliance evidence, phased cutover

Plan backward from the date your current contract ends, not forward from today. If your notice period is 60 days, your new provider should start discovery in week 1, not week 8.

The 7-Phase MSP Transition Plan

Each phase has one goal and one exit check. Do not start the next phase until the check passes.

Phase 1 — Read the contract before you give notice

Before you tell your current MSP anything, find out what your contract requires and what it entitles you to. Notice given too early can trigger slow service or lost leverage. Notice given incorrectly can trigger fees.

Look for these clauses:

Clause	What to check
Term and auto-renewal	End date, renewal length, the deadline for non-renewal notice
Termination	For convenience vs for cause, early-termination fees, cure periods
Offboarding or transition assistance	Whether the MSP must hand over documentation and credentials, and at what cost
Data ownership and return	That your data is yours, the format it comes back in, and the deadline
Equipment and licenses	Which firewalls, backup appliances and software licenses belong to the MSP, not you
Security responsibilities	Who owns what, as recommended in CISA advisory AA22-131A

Exit check: you know your notice deadline, your exit costs, and what the MSP owes you on the way out.

Phase 2 — Select the new provider first

Sign the new provider before giving notice, so there is never a day without coverage. The new MSP should lead the transition plan, because it has done this before and you probably have not.

Ask each candidate for a written onboarding plan with named owners and dates, and ask how they handle an uncooperative outgoing provider. Their answer tells you a lot. (Full question list below.)

Exit check: new contract signed, transition plan agreed, start date at least two weeks before the old contract ends.

Phase 3 — Inventory everything the old MSP touches

You cannot hand over what you have not listed. Build the inventory with the new provider, using discovery tools where possible rather than relying only on the old MSP’s records.

Devices: laptops, desktops, servers, firewalls, switches, Wi-Fi, printers, phones.
Cloud and SaaS: Microsoft 365 or Google Workspace tenant, line-of-business apps, accounting and CRM systems.
Licenses and subscriptions: who the billing contact is, and who the reseller of record is.
Security tools: antivirus or EDR, email filtering, MFA, firewall subscriptions.
Backup: what is backed up, where, how often, and who holds the encryption keys.
Third-party vendors: internet providers, phone systems, copier leases, software vendors who need a new “authorized contact”.
Documentation: network diagram, IP plan, runbooks, open tickets, and known issues.

Exit check: a single asset and account register, reviewed by you, the new MSP, and (ideally) the old MSP.

Phase 4 — Take back ownership of credentials, tenants and domains

Every critical system should have an admin account that belongs to your company, not to either MSP. This is the most important phase, and the one competitors cover least.

Create company-owned break-glass accounts. Make at least one global admin in Microsoft 365 (or Google Workspace) that uses a company-owned mailbox, has MFA, and is stored in a password vault you control.
Review Microsoft 365 partner relationships. In the Microsoft 365 admin center, under Settings > Partner relationships, you can see which partners hold delegated admin roles and remove a partner’s GDAP roles. Removing roles does not end the billing relationship, according to Microsoft’s partner management guidance, so move licensing separately. Do not remove the old partner yet. Just record what they have.
Secure the domain. Confirm your company is the registrant of your domain and that you hold the registrar login. Under the ICANN Transfer Policy, a material change of registrant can trigger a 60-day transfer lock, so change ownership details early, not on cutover day.
Collect remaining credentials (firewall, Wi-Fi controllers, backup consoles, hypervisors, line-of-business admin) through a shared password vault, never by email or spreadsheet.
Lower DNS TTLs on records you will change (mail, VPN, web) to a few minutes, 48 hours before cutover, so changes take effect quickly and can be reversed quickly.

Exit check: you can log in as admin to every critical system without asking either MSP.

Phase 5 — Run both providers in parallel

A one-to-two-week overlap, where both providers monitor your systems, is the single best protection against downtime. The new provider installs its tools and learns the environment while the old provider is still accountable.

During the overlap:

The new MSP deploys its remote monitoring and management (RMM) agent, EDR, and backup, and confirms they report from every device.
Run a test restore of a real file, a mailbox, and (if you have one) a server. A backup that shows “successful” but has never been restored is not proof of recovery.
Agree on who answers help desk calls on which day. Publish one phone number and email to staff.
Hold a joint call with both providers. Professional MSPs handle these routinely.

Shorter overlaps (24–48 hours) can work for small, cloud-only offices. Longer ones cost more because you pay two providers, but they buy time to find surprises.

Exit check: the new provider’s monitoring and backups are verified on 100% of in-scope devices, and one restore test has passed.

Phase 6 — Cutover in a planned window, with a rollback

Cutover is the moment responsibility formally moves, and it should happen in a planned low-traffic window with a written rollback. For most Dallas offices, that means a Friday evening or weekend, avoiding month-end close, payroll runs, and your busy season.

A cutover plan lists, in order: each change, who makes it, how to test it, and how to reverse it. Typical cutover tasks include switching firewall management, email filtering or MX records, VPN, and help desk routing.

Test the workflows that make you money, not just whether systems are “up”: a staff member logging in remotely, sending an external email, printing, running the accounting or practice-management system, and taking a card payment if you do.

Why downtime cost matters: ITIC’s 2024 survey found that one hour of downtime costs over $300,000 for more than 90% of mid-size and large enterprises. Smaller firms lose far less in absolute terms, but you can estimate your own number: staff affected × loaded hourly cost, plus revenue lost per hour.

Exit check: all business-critical workflows pass testing, and the rollback was not needed or was executed cleanly.

Phase 7 — Remove old access and stabilize for 90 days

On cutover day, revoke every form of access the old provider had, then verify it is gone. Lingering access is the most common way a switch leaves you exposed.

Remove the old partner’s delegated admin roles in Microsoft 365.
Uninstall the old provider’s RMM, remote-control, and backup agents from every device, and confirm in the new RMM that none remain.
Disable or delete the old MSP’s named and shared accounts on firewalls, servers, Wi-Fi and SaaS apps.
Rotate passwords on shared admin, service, and Wi-Fi accounts.
Update “authorized contact” records with your ISP, phone carrier, and software vendors.
Request written confirmation from the old MSP that it has returned or destroyed your data, as your contract allows.

Then run a 90-day stabilization period: weekly check-ins for the first month, then reviews at 30, 60, and 90 days covering ticket volume, response times, open risks, and documentation completeness.

Exit check: no old-provider access remains, and the 90-day review shows stable service.

The new provider’s tools go in from Phase 3, both providers run side by side in Phase 5, and every trace of the old provider’s access ends at cutover.

MSP Transition Checklist (Printable)

Read contract: notice deadline, fees, offboarding duties, data return
Identify MSP-owned equipment and licenses that must be replaced or bought out
Sign new provider; agree written transition plan with owners and dates
Give written notice to the current MSP, per the contract
Build asset, account, license, and vendor register
Create company-owned break-glass admin accounts with MFA
Record Microsoft 365 or Google Workspace partner roles
Confirm domain registrant and registrar login are company-owned
Move all credentials into a company-controlled password vault
Lower DNS TTLs 48 hours before cutover
Deploy new RMM, EDR, and backup; verify coverage on every device
Complete a successful test restore
Publish the help desk change to staff
Execute cutover in a planned window with a written rollback
Test business-critical workflows
Remove old partner roles, agents, and accounts; rotate shared passwords
Update vendor authorized contacts
Get written data-return or destruction confirmation
Hold 30-, 60-, and 90-day reviews

How to Fire Your IT Company When It Won’t Cooperate

If your outgoing MSP stalls, start from what you already control, and escalate in writing using the contract. Most stalls are slow responses, not outright refusals.

Secure what you can reach today. If you have any working global admin account, use it to create a company-owned admin account. Do this before giving notice if you suspect trouble.
Put requests in writing, citing the contract’s offboarding and data-return clauses, with a specific deadline.
Use the platform’s own controls. Microsoft lets a tenant’s global admin view and remove a partner’s delegated admin roles directly. If no one at your company has admin access, Microsoft support has a verification process to regain it.
Contact vendors directly. Registrars, ISPs, and software vendors can usually verify you as the account owner with business documentation.
Involve counsel if the provider holds data or access as leverage over a billing dispute. Keep a log of every request and response.

The best prevention is a contract that spells out offboarding duties before you ever need them.

Texas Rules That Affect an IT Provider Switch

Texas law does not regulate MSP switches directly, but two statutes raise the stakes if something goes wrong during one. This is general information, not legal advice. Confirm specifics with counsel.

Breach notification under §521.053

Texas Business and Commerce Code §521.053 requires businesses to notify affected people after a breach of sensitive personal information. Since September 1, 2023, under SB 768, a breach affecting at least 250 Texans must also be reported to the Texas Attorney General within 30 days of determining it occurred. A transition that leaves old access active, or loses track of who holds data, can make that clock harder to meet.

The SB 2610 safe harbor

SB 2610, effective September 1, 2025, can shield Texas businesses with fewer than 250 employees from exemplary (punitive) damages after a breach. The business must show it implemented and maintained a qualifying written cybersecurity program at the time of the breach. It does not remove liability for actual damages. A switch is a good moment to confirm your new provider will maintain and document that program, since evidence is what the safe harbor depends on.

Regulated industries (HIPAA, PCI DSS, CMMC)

If you handle health records, card payments, or defense contract data, add compliance steps: sign a new business associate agreement (HIPAA) before the new MSP touches patient data; confirm who maintains PCI DSS evidence; and confirm the new provider can support your CMMC level. Plan a longer, phased transition.

What Good MSP Onboarding in Dallas Should Include

Good onboarding in Dallas–Fort Worth combines remote discovery with on-site availability, and it is scheduled around local business and weather risk.

On-site coverage across the metro area you operate in (for example, Dallas, Plano, Irving, Frisco, or Fort Worth) for firewall, network, and cabling work.
After-hours cutover in Central Time, with engineers reachable during the window.
Weather-aware timing. North Texas sees severe spring storms, and the February 2021 winter storm showed how power and connectivity can fail regionally. Avoid cutovers in forecast severe weather, and confirm backups are stored offsite or in the cloud, not only on a local appliance.
A named onboarding lead, a written plan, and a documented environment at the end, which you own.
[Your company’s specific onboarding process, timeline and team, with real numbers if you have them.]

Common MSP Transition Mistakes

Giving notice before signing the replacement, which leaves a coverage gap.
Removing old tools before new ones are verified, which creates blind spots in monitoring and backup.
Trusting backup reports without a restore test.
Leaving the domain in the old MSP’s registrar account.
Forgetting Microsoft 365 partner roles, which can let a former provider administer your tenant.
Skipping staff communication, so employees call the old help desk for weeks.
No 90-day review, so documentation gaps are never closed.

Questions to Ask a New Managed IT Provider

What does your onboarding plan look like, week by week, and who owns each step?
How do you handle an outgoing provider that is slow to cooperate?
Which of your tools will you install, and who owns the licenses if we leave?
What will you hand back to us if we end the contract (documentation, credentials, data format)?
What are your response times by severity, and how are they reported?
Do you hold an independent audit such as SOC 2 Type II, and can we see the report?
How do you secure your own access to our systems (MFA, least privilege, logging)?
Who is our named contact, and how often will we review service?

Frequently Asked Questions

Can I switch IT providers without any downtime?

Yes, unplanned downtime can usually be avoided, but no provider can honestly guarantee zero disruption. Expect brief, scheduled changes during an after-hours cutover. Parallel running, tested backups, and a rollback plan keep those short and reversible.

How much notice do I need to give my MSP?

It depends on your contract. Thirty to ninety days is common. Check the auto-renewal date, too: missing a non-renewal deadline can lock you into another term.

What does it cost to switch managed IT providers?

Costs typically include any early-termination fees, a one-time onboarding fee from the new provider, overlap months paying both, and replacement of MSP-owned equipment or licenses. Get each in writing before you give notice.

Who owns my data and passwords when I leave an MSP?

Your data should belong to you, but ownership of accounts, licenses, and equipment depends on the contract. Confirm it in writing, and create company-owned admin accounts before you start.

Do I have to replace my hardware when I change IT companies?

Usually not. Most devices stay. Exceptions are equipment the old MSP owns or leases, such as some firewalls and backup appliances, and tools whose licenses are tied to the old provider.

What if my current IT company refuses to hand over admin access?

Escalate in writing using the contract, use your platform admin controls (such as Microsoft’s partner-relationships page), contact vendors directly as the account owner, and involve counsel if access is withheld as leverage.

Should I tell my current MSP I’m leaving before I hire a new one?

No. Sign the new provider first, then give notice according to your contract. That avoids a coverage gap and keeps your negotiating position.

Can I switch MSPs in the middle of a contract?

Often yes, by paying an early-termination fee or terminating for cause if the provider has breached service levels. Review the termination clause and document missed service levels before you raise it.

How do I know the old MSP has no access left?

Check Microsoft 365 or Google Workspace partner roles, scan every device for remote-access and RMM agents, review admin accounts on firewalls and servers, and rotate shared passwords. Ask the new provider for a written access-removal report.

Key Points: Switching IT Providers Safely

Hire the new provider before you give notice.
Treat the exit as a privileged-access handover, and track it task by task.
Own your admin accounts, domain, and password vault.
Overlap providers, test a restore, and cut over with a rollback.
Remove all old access on cutover day, then review at 30, 60, and 90 days.

Book a free AI readiness and IT consultation:

Call (24/7): (972) 200-3219
Email: support@ightysupport.com
Book online: Schedule a free consultation
Offices: 1509 W Hebron Pkwy, Suite 120, Carrollton, TX 75010 and 2001 N Lamar St, Suite 270, Dallas, TX 75202

How to Switch IT Providers in Dallas Without Downtime: A Step-by-Step MSP Transition Checklist