Ask any business that has changed IT partners what actually went wrong, and the answer is rarely the incoming supplier. It is the exit.
IT provider offboarding is the controlled recovery of everything your outgoing supplier holds on your behalf — tenants, licences, backups, credentials, documentation and monitoring agents — before their access is switched off for good. Done properly, nobody notices it happened. Done badly, it is the most common cause of permanent data loss in a support transition, and the damage usually surfaces weeks after everyone stopped paying attention.
This guide covers IT provider offboarding — the exit half of the move. If you are still deciding whether to change supplier at all, start with our walkthrough on how to switch IT support providers and come back here once notice is on the table. What follows assumes the decision is made and focuses purely on getting your estate back intact — a discipline most managed IT services contracts describe in a single vague paragraph.
Table of contents
- What IT Provider Offboarding Really Covers
- Everything Your Outgoing Provider Holds on Your Behalf
- Where Data Actually Goes Missing During an IT Provider Offboarding
- Step 1: Build the IT Provider Offboarding Register Before You Serve Notice
- Step 2: Reclaim Ownership of Tenants, Domains and Licences
- Step 3: Secure the Data Before Anything Is Uninstalled
- Step 4: Rotate Credentials and Close Every Access Path
- Step 5: Decommission the Outgoing Provider’s Tooling Safely
- Step 6: Verify the Handover With Evidence, Not Assurances
- The IT Provider Offboarding Checklist in One Page
- Mistakes That Turn IT Provider Offboarding Into Data Loss
- Final Thoughts: Offboarding Is a Controlled Shutdown
What IT Provider Offboarding Really Covers
Offboarding is a distinct workstream from onboarding, with a different owner, a different deadline and a different failure mode. Confusing the two is why so many transitions leave gaps.
Offboarding is not the mirror image of onboarding
Onboarding the new provider is additive: agents get installed, documentation gets written, monitoring starts reporting. IT provider offboarding is subtractive, and subtraction is where things break. Every removal is irreversible on somebody else’s timetable, and each one carries a small chance of taking data with it. The two workstreams overlap but must be tracked separately, with the removals explicitly sequenced after their replacements.
The notice period is the only window with leverage
While the contract is live, your outgoing supplier is contractually obliged to cooperate. The day it ends, that obligation becomes goodwill. Everything difficult — export requests, credential lists, tenant ownership transfers, backup extractions — should be requested and completed inside the notice period. An IT provider offboarding that runs past the final invoice depends entirely on whether somebody at the old firm still feels like helping.
Somebody in your business has to own it
The incoming provider cannot own offboarding, because they have no relationship with the outgoing one and no visibility of what exists. A named person on your side must hold the register, chase the outstanding items and sign off completion. Where nobody owns the process, IT provider offboarding quietly becomes nobody’s job and the gaps are discovered by accident.
Everything Your Outgoing Provider Holds on Your Behalf
Most businesses underestimate this list dramatically. An IT provider offboarding is only ever as complete as your understanding of what a support partner quietly accumulates over a few years.
Identity and tenant ownership
Your Microsoft 365 or Google Workspace tenant may be registered under the provider’s partner agreement, with their staff holding global administrator rights and delegated access granted at setup. This is normal practice and not sinister, but it means the keys to every mailbox, file and identity in your business sit in somebody else’s console. Establishing who holds those rights is the first substantive task in any IT provider offboarding.
Backups and the consoles that control them
Backup is where IT provider offboarding does the most damage when rushed. The backup software, the retention policy, the cloud storage bucket and the restore console frequently belong to the provider, purchased under their volume agreement and administered from their multi-tenant portal. Your data is genuinely yours; the platform holding it is not. Those are different questions with very different answers.
Licences bought through the provider’s agreements
Microsoft, antivirus, backup, email security and remote access licences are often purchased on the provider’s reseller agreements. When the relationship ends, those subscriptions can be reclaimed, transferred or cancelled. Each route has a different deadline and a different consequence, and a licence cancellation frequently triggers data deletion after a grace period nobody diarised.
Documentation, scripts and institutional knowledge
The undocumented estate is real. Firewall rules with no stated purpose, scheduled scripts running on a server nobody logs into, a bespoke integration maintained by one engineer. This knowledge lives in the provider’s documentation platform, which you almost certainly cannot access. Requesting a full export before the relationship cools is one of the highest-value steps in the entire checklist.
Where Data Actually Goes Missing During an IT Provider Offboarding
Data loss during an IT provider offboarding is rarely malicious. It is almost always a default setting doing exactly what it was designed to do, at a moment when nobody was watching.
Agent removal that deletes the backup set
Many backup products treat uninstalling the agent as a decommissioning event and purge the associated backup set, either immediately or after a short retention window. An engineer tidying up at the end of a contract triggers this without a second thought. This single behaviour accounts for more permanent loss in IT provider offboarding than every other cause combined.
Tenant separation that strips historic mail
Where mailboxes were provisioned under a provider-managed tenant, separating them can leave archives, retention holds and shared mailboxes behind. Live mail migrates; the archive quietly does not. Businesses discover this months later when somebody needs correspondence from three years ago for a dispute or an audit.
Licence reclamation with a 30-day fuse
Reclaimed licences typically start a grace period — commonly thirty days — after which the underlying data is deleted. If your IT provider offboarding runs late, that timer expires while migration is still in progress. The deletion is entirely legitimate, entirely documented and entirely irreversible.
The shared resources nobody listed
Shared mailboxes, distribution groups, service accounts, meeting-room resources and departed-staff mailboxes on retention hold rarely appear on anybody’s inventory. They are not attached to a current user, so a user-by-user migration misses them completely. Enumerate resources separately from people.
Step 1: Build the IT Provider Offboarding Register Before You Serve Notice
The register is the single artefact that makes everything else possible. Build it before notice, because after notice the tone of every conversation changes.
Start from billing, not from IT
Your invoices are the most honest inventory you own. Every line item on the provider’s monthly bill corresponds to something running in your estate — a licence, a backup, a monitored device, a hosted service. Working backwards from twelve months of invoices surfaces systems that no technical inventory captured, and it is the fastest way to seed an IT provider offboarding register.
Record where each system is administered from
For every system, note the console it is managed through, who owns the account, and whether that account is yours or the provider’s. This distinction determines whether you need a transfer, a repurchase or simply a password. Without it, IT provider offboarding proceeds on assumption, and the assumption is usually optimistic.
Capture retention settings and deletion timers
For anything holding data, record the retention period and what happens on cancellation. Backup retention, mailbox retention, log retention and archive policies all have defaults that activate on termination. Knowing the shortest fuse in your estate tells you how much slack the transition timeline actually has.
Get commitments in writing while cooperation is contractual
Convert the register into a written request with dates attached, sent while the contract is live. A polite, specific, itemised email creates a record and sets expectations. Vague requests for “the handover pack” produce vague results; a numbered list produces a numbered response.
Step 2: Reclaim Ownership of Tenants, Domains and Licences
Ownership is the difference between an inconvenience and a crisis. This is the stage of IT provider offboarding that turns borrowed access into permanent control.
Take the global administrator role first
Before anything else, ensure at least two accounts under your control hold global administrator rights in every tenant, secured with multi-factor authentication and recorded in your own password manager. Do this early and calmly. Every subsequent step in IT provider offboarding depends on being able to act without asking permission from the organisation you are leaving.
Remove delegated partner access on your schedule
Delegated administrative privileges let a partner administer your tenant from their portal. Removing that relationship is straightforward, but do it deliberately rather than reflexively — the outgoing provider may still need access to complete agreed handover tasks. Agree a removal date, then enforce it. Unremoved delegated access is a standing cybersecurity exposure long after the relationship has ended.
Move domain and DNS control early
Domain registration and DNS hosting are frequently held in the provider’s account. DNS controls mail routing, authentication records and every public service you run, so an accidental lapse takes the business offline in a way customers see immediately. Transfer registrar control and document every existing record before anyone changes anything.
Transfer or repurchase licences deliberately
Decide for each subscription whether to transfer it to your own agreement, repurchase it through the incoming provider, or retire it. Record the deadline attached to each decision. Licences left to lapse mid-transition are the most avoidable failure in IT provider offboarding, and they are always discovered on a Monday morning.
Step 3: Secure the Data Before Anything Is Uninstalled
This is the part of IT provider offboarding that prevents irreversible loss. Everything else can be redone; deleted data cannot.
Take an independent copy you control
Before any agent is removed or any licence lapses, take a complete copy of business-critical data into storage that you own outright and that neither provider administers. This is deliberately redundant. It exists solely so that a mistake during IT provider offboarding is an inconvenience rather than an extinction event, and it can be retired once the transition is verified.
Verify restores, not just backup jobs
A green backup dashboard reports that a job ran, not that the data is recoverable. Restore a real file, a real mailbox item and ideally a full server into an isolated location, and confirm the contents open correctly. This is the only evidence that matters, and the notice period is the last time you can ask the outgoing provider to help produce it.
Export the systems that cannot be migrated
Some platforms cannot be transferred at all — the provider’s ticketing system, their documentation portal, their monitoring history. Request exports in a usable format while the contract is live. Ticket history in particular is worth having: it is the written record of every recurring fault in your estate and it is invaluable to whoever inherits the environment.
Freeze retention policies during the transition
Where you can, extend retention windows for the duration of the move. A longer window costs a small amount of storage for a few weeks and converts several irreversible deadlines into recoverable ones. It is the cheapest insurance available during IT provider offboarding.
Step 4: Rotate Credentials and Close Every Access Path
Access outlives relationships. The purpose of this step is to ensure that when the contract ends, so does every route into your systems.
Build the full access inventory
List every credential the outgoing provider could hold: domain administrator accounts, local administrator passwords, firewall and switch logins, VPN profiles, remote access tools, service accounts, API keys, SaaS administrative logins and the shared password vault itself. IT provider offboarding fails at exactly the point where this list is incomplete, because the forgotten item is never the obvious one.
Rotate on a published schedule, not all at once
Rotating everything simultaneously breaks integrations and generates an outage indistinguishable from a real incident. Sequence the changes across the transition, publish the schedule to both providers, and test after each batch. Controlled rotation is a cybersecurity requirement and an availability requirement at the same time, and treating it as only the former is how businesses take themselves offline.
Do not forget the non-human accounts
Service accounts, scheduled tasks, backup agents, monitoring integrations and API tokens authenticate without anybody logging in. They are invisible in a user-focused review and they are precisely what remains valid after every human account has been disabled. Every serious IT provider offboarding includes an explicit sweep for non-human credentials.
Produce evidence for insurers and auditors
Cyber insurance policies and compliance frameworks increasingly ask whether third-party access is revoked on termination. Keep dated records of what was rotated, what was revoked and when. This costs nothing at the time and is extremely difficult to reconstruct afterwards, particularly if a claim or an audit arrives a year later.
Step 5: Decommission the Outgoing Provider's Tooling Safely
Removal is the last stage of IT provider offboarding and the most dangerous. Sequence it deliberately.
Replace before you remove
Never uninstall a monitoring, antivirus, patching or backup tool until its replacement is installed, verified and reporting correctly. A gap of even a few days leaves devices unprotected and unpatched. The correct order in IT provider offboarding is always install, verify, then remove — and the verification step is not optional.
Watch for tools that take data with them
Backup agents, archiving tools, email security gateways with quarantined mail and endpoint tools holding forensic history can all destroy data on uninstall. Before removing any tool, confirm what happens to its stored data and extract anything you need first. When the documentation is ambiguous, ask the vendor rather than the departing engineer.
Confirm the billing actually stops
Reconcile the final invoice against the register. Subscriptions that continue billing after termination are common and usually accidental, but a subscription still billing may also be one still holding your data. Both facts are worth knowing, and the reconciliation closes the financial and technical loops together.
Step 6: Verify the Handover With Evidence, Not Assurances
An IT provider offboarding is complete when it has been demonstrated, not when it has been declared.
Ask for a written completion statement
Request a short written confirmation from the outgoing provider listing what was handed over, what was deleted, what access was revoked and what remains outstanding. Most reputable firms provide this willingly. The document is useful evidence and the act of requesting it frequently surfaces two or three items nobody had mentioned.
Test the things you assume still work
Send external mail and confirm authentication passes. Restore a file. Trigger a test alert. Check that patching is reporting and that backups completed overnight. Verifying an IT provider offboarding takes an afternoon, and every item that fails is one you can still fix while the relationship is warm.
Keep a contact route open for a defined period
Agree a named contact and a short window — thirty days is typical — during which questions can still be asked. Put it in writing. Most post-transition questions are small and quickly answered, but only if somebody is still willing to answer them.
The IT Provider Offboarding Checklist in One Page
Everything above, compressed into the IT provider offboarding sequence a business actually works through.
Before notice is served
Build the register from twelve months of invoices. Confirm who holds global administrator rights on every tenant. Record retention settings and cancellation behaviour for anything storing data. Read the termination and data-return clauses in the contract. Contract the incoming provider before serving notice on the outgoing one.
During the notice period
Take independent copies of critical data. Verify restores. Request exports of ticket history and documentation. Transfer tenant, domain and DNS ownership. Decide the fate of every licence and diarise each deadline. Install and verify replacement tooling. Begin the scheduled credential rotation. Track every item on the register to a named owner and a date.
On and after the final day
Revoke delegated access and remaining credentials. Remove the outgoing provider’s tooling only after replacements are verified. Obtain the written completion statement. Reconcile the final invoice. Test mail flow, backups, patching and alerting. Retain your independent copy until the estate has run cleanly for a full backup cycle, then retire it.
Mistakes That Turn IT Provider Offboarding Into Data Loss
These are the failures that recur across every IT provider offboarding, and each one is a sequencing error rather than a technical one.
Serving notice before the register exists
Notice starts a clock and changes the relationship. Serving it before you know what the provider holds means discovering the gaps while goodwill is draining and the deadline is fixed. Build the register first; it is the only part of IT provider offboarding that is genuinely easier before notice than after.
Assuming the contract entitles you to your data
Most contracts commit to returning data in some form, but the format, the timescale and the cost are frequently unspecified or chargeable. A right to your data is not the same as a practical route to receiving it in a usable state. Check the clause and the mechanism, not just the principle.
Letting the outgoing team uninstall on their own timetable
A departing engineer tidying up efficiently is a genuine risk, not an unkindness. Agree explicitly that no removals occur without your written confirmation that the replacement is verified. State it once, in writing, early.
Treating offboarding as the incoming provider’s job
The new supplier will happily help, but they cannot see what they were never told about and have no standing to chase the old one. IT provider offboarding is a client-owned process supported by both suppliers, and the businesses that hand it to a vendor entirely are the ones that discover the gaps last.
Final Thoughts: Offboarding Is a Controlled Shutdown
The instinct during a supplier change is to focus forward — new contract, new team, new tooling. The risk sits behind you, in the systems that are about to be switched off by people who no longer work for you. That is why IT provider offboarding deserves its own plan rather than a line on somebody else’s.
What good looks like
A completed IT provider offboarding leaves you with administrative ownership of every tenant, an independent verified copy of your data, a rotated credential set, replacement tooling proven in place, an exported record of your estate’s history, and a written statement of what was handed over. None of that is technically difficult. It is simply a list somebody has to own.
Where to start this week
Pull twelve months of invoices and write down what each line item represents. Then check who holds global administrator rights on your primary tenant. Those two tasks take an afternoon between them and will tell you more about your exposure than any conversation with either provider. If you would like a second pair of eyes on the register before you serve notice, our team reviews transition plans regularly and is happy to look.
