Keys, Codes and Configs: Building an IT Exit File Before You Need One

An IT support agreement rarely ends at a convenient moment. It might expire quietly, be replaced after a tender, follow a merger at the provider, or arrive as a letter from an administrator. The cause changes the atmosphere around the conversation but not the substance of it. What has to change hands is the same in every case, and the businesses that fare best are the ones who started listing it before anything was said out loud.

The useful framing is not "are we leaving" but "what would we need if we had to run this ourselves on Monday". Everything below follows from that question.

Begin with the paperwork, not the technology

Read the termination clause before you read anything else. Notice periods of thirty, sixty and ninety days are all common, and the notice date is easy to miss when it sits inside a renewal cycle. Look for three specific provisions: a duty to provide reasonable assistance during handover, a clause covering the return or deletion of data, and any charge attached to either.

If the assistance clause is absent, expect to negotiate for it. Handover days are a deliverable, and a supplier who has not priced them will price them now.

The four categories that must transfer

Administrative control. Global administrator rights on the Microsoft 365 or Google Workspace tenant, the domain registrar account, DNS management, the internet service provider portal, mobile fleet management, the backup console, endpoint protection, the firewall, the Wi-Fi controller and any remote monitoring agent installed on your machines. Control means the ability to change a setting without asking permission.

Data, in a usable format. Mailboxes, file shares, line-of-business application data, the ticket history that documents your estate, and the backups themselves. A backup you have never restored is a rumour, so ask for a test restore before the contract ends rather than after.

Configuration knowledge. Network diagrams, the IP addressing scheme, VLAN assignments, firewall rules, certificate expiry dates, licence keys, build documentation and the reasoning behind decisions that look odd until explained.

Commercial ownership. Which licences are held in whose name, which hardware was bought outright and which is rented, which circuits and phone numbers sit on which account, and who holds the domain names and TLS certificates.

Ninety days out: the inventory

Build a single register, owned by one named person on your side. Every item gets an owner, a location and a status. Include the things nobody thinks about until they break: the card that pays for certificate auto-renewal, the personal mobile number that receives multi-factor prompts for the administrator account, the distributor that actually holds the Microsoft licences, the small line rental on a secondary site that appears on no invoice you recognise.

Sixty days out: the access transfer

Administrative rights should be granted to your own accounts, not transferred by password handover. Create your own global administrator identity, confirm it works, and keep its recovery details with the business rather than an individual. Rotate shared passwords once your access is proven, and ask for a written list of every account, portal and subscription the provider has ever created on your behalf.

Thirty days out: the parallel run

Overlap is not indecision. Two to four weeks of dual coverage, with the outgoing supplier reachable for escalations and the incoming one shadowing, removes most of the risk from the changeover. Agree a change freeze for the final fortnight unless something is genuinely broken, and hold a short weekly checkpoint with a named contact on each side.

The phone system deserves its own page

The telephony element is where handovers most often go thin. Ask for the call flow diagrams, the auto-attendant scripts and their recorded prompts, the direct-dial mapping, hunt group membership, voicemail-to-email configuration, and any call recording archive with its retention policy. Confirm who holds the SIP credentials and the provider portal, and confirm the process for porting numbers out. If any number sits on an account in the supplier's name, resolve that before the last day, not after it.

Week one after: the sweep

Remove the outgoing provider's remote access and monitoring agents, confirm that no scheduled tasks, backup jobs or mailbox rules remain pointed at their infrastructure, and check that their contact details have been replaced everywhere they appear — including on the public website and in the domain's technical records. If they held personal data as a processor, ask for written confirmation of return and deletion, and file it. As data controller, that record is yours to keep.

Common gaps, in the order they bite

A domain name registered in the supplier's name. A tenant where the only global administrator is a technician who left last year. Licences bought through a reseller relationship that quietly lapses. Documentation that exists but was never shared. A support contract that ends on a Friday with no out-of-hours cover until the following Monday.

None of these are dramatic. They are simply the ordinary consequence of a relationship that was never designed to end. A handover file, maintained quietly in the background and reviewed once a year, turns an uncomfortable fortnight into an administrative one.