How to Switch Managed IT Providers Without Losing Data or Sleep

Why this is the most stressful IT decision SMBs make

Switching managed IT providers is genuinely scary because the outgoing provider holds the keys to everything: your domain, your email, your backups, your cloud accounts. Stories of providers refusing handover, holding data hostage, or "accidentally" wiping configurations are common — and they keep small businesses stuck with bad providers far longer than they should be.

The good news: the law (in the EU, Israel, and most jurisdictions) is on your side, and a clean handover is entirely doable in 4–6 weeks if you plan it properly. This article walks through that plan.

What you actually own (and what you don't)

Before you start a switch, get clear on ownership. In most setups for a small business, you own:

Your domain name (registered in your business's name)

Your Microsoft 365 or Google Workspace tenant (paid for in your business's name)

Your data inside those tenants (email, files, calendars)

Any business accounts paid by your business (Acronis, 1Password, etc.)

Your provider should be administering these — not owning them. If your domain is registered in their company name, or your M365 tenant is on their billing, that is a structural problem you need to fix immediately, regardless of whether you switch.

The 4-week switch plan

Week 1: Audit and document

Before notifying your current provider, document everything you can on your own:

Every business account and where the credentials live

Every domain you own and where it's registered

Every device that's managed (laptops, phones, servers)

Every backup that's running and where backups are stored

Every recurring invoice you pay for IT-related services

Your new provider will work from this list.

Week 2: Notify and request handover

Notify your current provider in writing. Reference your contract's termination clause (most managed IT contracts require 30–60 days notice; if yours doesn't say, 30 days is the legal default in most EU jurisdictions). In the same notice, formally request:

All admin credentials for every system they manage

All API keys, certificates, and recovery codes

All documentation and runbooks

Confirmation of where backups are stored and how to access them

A list of any third-party services they manage on your behalf

Under GDPR (and Israeli privacy law equivalents), you have a legal right to your data. A provider refusing to hand it over is breaking the law, not just being awkward.

Week 3: Parallel run

This is the safest pattern: have both providers active for one week. Your new provider takes over administration of email, devices, and backups. Your old provider remains active in case anything was missed. Don't skip this week.

Week 4: Cutover and decommission

Once the new provider has confirmed everything is migrated and tested, formally decommission the old provider:

Remove their admin access from every system

Rotate any shared credentials

Confirm in writing that they no longer hold any of your data

Final invoice and contract closure

Red flags during a switch

These behaviours from an outgoing provider are not just frustrating — they're warnings:

Refusing to provide credentials in writing ("we'll just transfer them when needed")

Charging an "exit fee" that wasn't in your contract

Claiming they own your domain or M365 tenant

Disabling services or "accidentally" deleting accounts during handover

Slow-walking responses past your notice period

If any of these happen, document everything in writing and escalate. In the EU, your data protection authority will take complaints seriously when a provider obstructs lawful data access. Your incoming provider should also know how to navigate these — that's part of why you hire them.

What a good handover looks like

A clean switch ends with:

You hold every admin credential, in your password manager, in your name

You have written documentation of how everything works

Your new provider has tested every critical system (email send/receive, backup restore, login from a new device)

The old provider has confirmed in writing they no longer have access

You haven't lost a single email, file, or working hour

That's the bar. It's achievable. Don't accept less.