Who Holds the Keys? A 90-Minute Rehearsal for Changing IT Support

Changing IT support shouldn't feel like a heist. Yet for plenty of UK small businesses, the moment they decide to move providers is the moment they discover who actually holds the keys: the tenant, the domain, the backup console, the phone system. The notice period gets all the attention. The admin rights get all the consequences.

The good news is that you don't need to be leaving anyone to run this exercise. Treat it as contingency planning—a fire drill, not a divorce. The aim is to answer one question honestly: if we had to change support provider next month, could we? Not "would it be pleasant?" Just "could we?"

The notice period is rarely the real problem

Contracts matter, and you should know your notice terms. But in practice, the awkward part of a provider handover is usually quieter: a global admin account nobody can sign into, a domain registrar login tied to a former employee's email, a backup system that only the outgoing provider can open, or a phone system where the numbers are held in someone else's portal.

None of that is necessarily malicious. It is usually just the result of years of small, sensible decisions made quickly. The fix is equally small and sensible: rehearse the handover before you need it, and write down what you find.

The 90-minute rehearsal

Book a quiet afternoon, put the kettle on, and gather one person who can make decisions and one person who can click through admin portals. Keep the provider out of this session. You are not accusing anyone of anything; you are checking your own house keys.

Minutes 0–20: Follow the keys

Start with Microsoft 365 or Google Workspace, whichever you use. Count the Global Administrators. Who are they? Is there a break-glass account with credentials stored somewhere sensible—not in a shared inbox, not in one person's head? Is multi-factor authentication on for every admin? Then move outward: the DNS registrar, the website host, the backup console, the phone system portal, the ISP account, the line rental account.

For each one, note three things: who can log in, where the credentials live, and whether you could get in today without asking the provider. Anything you cannot access is a finding, not a failure.

Minutes 20–45: Follow the names

The names on accounts matter as much as the passwords. Check who owns the Microsoft 365 licences and who the billing contact is. If a reseller or CSP sits between you and Microsoft, note that relationship. Check the tenant's primary domain and confirm that SPF, DKIM and DMARC records are documented, not just working.

Then look at the smaller things that cause disproportionate chaos: shared mailboxes, Teams phone numbers, app registrations, SSL certificates, the account that renews your domain, and any line-of-business SaaS tools where the provider is listed as the technical contact. Write down what you find in plain English.

Minutes 45–70: Follow the data

Where do files actually live? For most small firms, it is a mix: SharePoint, OneDrive, a local server, a NAS in the cupboard, and perhaps a cloud storage account someone set up years ago. You don't need a full data map. You need a short list of the systems that matter and a realistic answer to: how would we get the data out?

If you have backups, try a small restore. Restore one folder, not the whole company. Open a sample export from the line-of-business application. Check whether email retention or litigation hold settings are documented. A backup you have never opened is a subscription, not a safety net.

Minutes 70–90: Write the one-pager

Finish by writing a single page titled "If we changed IT provider tomorrow." List the key systems, the named owners, where credentials are stored, the known gaps, and the next review date. Store it somewhere offline and somewhere sensible. Review it quarterly, or whenever a key person leaves.

The handover checklist

• Microsoft 365: at least two global admins you control, MFA enabled, break-glass account documented, licence and billing ownership confirmed.
• DNS: registrar login, renewal date, domain lock status, technical and admin contacts, SPF/DKIM/DMARC records recorded.
• Backups: console access, retention settings, a recent successful restore test, and an export format you understand.
• Phone system: admin portal, number ownership, portability notes, call routing documentation, and line rental account details.
• Data handover: file locations, export formats, sample exports, shared mailboxes, and any provider-hosted applications.
• Documentation: your one-pager, credentials stored securely, and a named internal owner for each item.

Trust, not blame

A good IT provider will not be offended by any of this. They should be able to hand you a list of admin accounts, explain where the domain is registered, and show you a restore that works. If they can't, that is useful information—quietly gathered, well before you need it.

The point of the rehearsal is not to prepare for a fight. It is to make sure that if you ever do change providers, the process is uneventful. Boring handovers are the goal. A small firm that knows who holds the keys is a small firm that can make calm decisions—about support, about cloud, about the next three years. And that is exactly the kind of contingency planning worth 90 minutes.