Microsoft 365 tenant handover checklist

Changing IT providers goes smoothly when you know what you hold before the old provider stops answering. Use this list to ask for everything in one request. It is written for Microsoft 365 businesses of 10 to 150 people, and it is printable: use your browser's print command and the page drops its navigation and background.

Admin access

• A list of every account holding Global Administrator or another admin role, and the person behind each one.
• Admin accounts in your business's name, with passwords and MFA methods you control. Accounts tied to a departing technician's phone are a lockout waiting to happen.
• Any shared "admin@" or provider-named accounts: who uses them, and a date to disable them.
• App registrations and enterprise apps the provider added (backup, monitoring, remote support, reporting), and what each has permission to do.

Emergency access

• At least two emergency access accounts, cloud-only on the .onmicrosoft.com domain, excluded from blocking Conditional Access policies.
• Where their credentials or security keys are stored, and who can reach them.
• The date they were last tested.

Partner relationships and licensing

• The partners listed under Partner relationships in the Microsoft 365 admin center, and the roles each holds, including any granular delegated admin (GDAP) relationships.
• Which partner bills your Microsoft licences today, on which subscriptions, with which renewal or term dates.
• Licence counts against active users, including leavers still holding a licence.
• A plan for removing the outgoing provider's admin roles once the new arrangement works. Removing roles doesn't end a reseller relationship, which is handled separately.

Domains and DNS

• The registrar for every domain you use, the login, and whose name the domain is registered in.
• Who hosts DNS, the login, and an export of the current records.
• Mail records: MX, SPF, DKIM and DMARC, plus anything pointing at third-party services.
• Renewal dates for domains and certificates.

Intune, Autopilot and devices

• A device list with serial numbers, users and purchase dates.
• Confirmation that Autopilot devices are registered to your tenant, not the provider's.
• Where BitLocker recovery keys are kept. With Intune they appear in the encryption report.
• The Apple MDM push certificate: which Apple ID created it and when it expires. It lasts 365 days and must be renewed with the same Apple account.
• Compliance, configuration and update policies, with a note of anything that was set up as a one-off exception.
• Local admin passwords for any device not managed by Intune.

Backups

• Which product backs up Microsoft 365 (mail, SharePoint, OneDrive, Teams), what it covers and how long it keeps data.
• Whose account the backup lives in. If it is the provider's, agree how and when the data is exported or kept during the changeover.
• The date and result of the last test restore.
• Backups of anything outside Microsoft 365, such as a line-of-business database.

Security tools and contracts

• Endpoint protection in use, and whether it is tied to the provider's own console or licence.
• Any monitoring, security operations or email filtering service, and when its contract ends.
• Open security incidents or known issues, in writing.

Documentation and other systems

• A password vault export, or the credentials themselves, for every system the provider manages.
• Network details: firewall, wi-fi, internet service and their logins.
• Line-of-business applications, their vendors, support contacts and licence keys.
• Printers and scanners, including how scan-to-email authenticates.
• A record of changes made in the last twelve months.

Timing the cutover

1. Collect everything above and confirm the new provider can sign in with its own accounts.
2. Change passwords on any shared accounts the outgoing provider knew, and re-register MFA where it was set up on their devices.
3. Remove the outgoing provider's admin roles and accounts, and disable any tools of theirs you aren't keeping.
4. Keep the old backup until the new one has completed a test restore.

If the outgoing provider won't help

It happens, and it isn't fatal. As long as someone in the business holds a working Global Administrator account, most of this list can be rebuilt from the tenant itself. Our onboarding starts with a free read-only assessment that maps what exists, and the handover is planned so that it doesn't depend on the current provider's cooperation. See how switching works.

When you leave us

The same list applies in reverse. Our agreement is month to month with a month's notice, and on exit we hand over every credential, document and configuration record we hold.