Build an ownership and access register
List the domain registrar, DNS, Microsoft 365 tenant, backup services, application subscriptions, internet accounts, devices, security tools, and remote-management systems. For each, record the account holder, billing contact, authorized administrator, recovery process, and transfer requirements.
Ownership, administration, and billing are different relationships. A provider may manage a customer tenant or supply licenses without owning the customer's business identity. Microsoft offers customer-approved, least-privileged, time-bound delegated administration through GDAP; ask which administrative relationships actually exist in your tenant. [S02]
Your contract and supplier arrangements determine specific rights. Have counsel review unclear ownership or retention language rather than relying on a general promise that everything can be transferred instantly.
Collect usable documentation, not just passwords
Ask for a secure handover of system inventories, network diagrams, configuration records, recovery procedures, licensing information, and current vendor contacts. Avoid ordinary email for credentials. Verify that company-controlled emergency access works and has appropriate safeguards before changing the old provider's permissions.
Documentation should be current enough for another qualified team to operate the environment. Also identify information the outgoing provider legitimately owns, such as its internal business records or proprietary tools, so expectations are explicit.
When the old provider will not cooperate
Start with the contract, an authorized written request, an inventory of missing items, and a reasonable handover plan. Preserve communications. Escalate disputed ownership, unpaid fees, access obstruction, or suspected misconduct to leadership and counsel. A vendor's recovery or ownership-verification process may help when the business is the rightful account holder.
Do not ask employees to bypass access controls or seize accounts they are not authorized to administer. Whether particular conduct is unlawful or a contractual breach depends on facts this article cannot determine. The goal is continuity and a defensible transfer, not a technical contest between providers.
Remove old access without creating a new outage
The incoming and outgoing teams should coordinate replacement monitoring, backups, endpoint protection, remote access, and delegated permissions. Establish which protection is active before removing the old agent. Check for incompatible overlapping tools and retain evidence needed for an ongoing incident or legal hold.
After handover, review accounts, sessions, recovery methods, and unattended access; rotate or replace affected secrets through an approved process. Test critical workflows with actual users. Blue Tree Technology® can discuss a transition scope that separates access recovery, migration, and ongoing management. No provider should promise a frictionless exit without examining the environment and agreement first.