Most firms that switch IT providers assume the old company's access ends when the invoice does. It doesn't.
I've taken over Microsoft 365 tenants where the previous provider still held administrative access months after the relationship ended. Not out of malice — nobody ever revoked it. Ending the billing relationship with a Microsoft partner does not automatically remove their admin access to your tenant. Those are two separate switches, and only one of them gets flipped when you stop paying.
It's like changing property managers and never asking for the keys back. The lease is over. The keys still work.
A clean handover is a short checklist. You can see every partner holding admin roles in your tenant yourself — Microsoft 365 admin center, Settings, Partner relationships — and remove those roles in four clicks. Then look for admin accounts living inside your tenant under a technician's name. Then rotate the shared logins nobody documents: the alarm panel, the copier portal, the domain registrar. That last one causes more outages during a transition than anything else on the list.
Do it on day one of the switch, not day ninety. The awkward phone call is cheaper than explaining to a client why their matter files went dark for a day.
If your firm changed IT companies in the last two years and nobody walked you through this, it's worth ten minutes before your next cyber renewal.
Want the next one in your inbox?
One practical Microsoft 365, Copilot, Azure, or security move per week — plain English, no pitch.
Subscribe via email