The Real Reason Businesses Stay With Bad IT Providers
Every few months, we have a conversation with a business owner who has been unhappy with their IT provider for one, two, sometimes three years — but has not switched. When we dig into why, it almost always comes down to one of three fears.
Fear number one: the transition will cause downtime and disruption. The business has become dependent on whoever set up the systems, and the thought of moving everything to someone new feels like open-heart surgery while running a marathon.
Fear number two: the new provider will not understand our systems as well as the current one. There is something that feels like security in familiarity, even when the familiar is failing you. The devil you know feels safer than the devil you do not.
Fear number three: there is critical information locked in the current provider’s head (or worse, their systems) that you might lose. Passwords nobody has written down. Network diagrams that exist only in someone’s memory. Vendor contacts that disappear with the relationship.
All three fears are legitimate. We have seen transitions go badly when they are not managed carefully. But a well-structured transition — one where the incoming provider knows what they are doing — should cause zero unplanned downtime and minimal disruption.
This guide gives you the exact process. Read it before you make any calls.
Before You Give Notice: What You Need to Know First
The single most important piece of advice in this entire guide is this: do not give notice until you have an incoming provider confirmed and the transition plan agreed.
Giving notice without a plan accelerates your departure timeline without ensuring your destination is ready. Some providers become uncooperative the moment notice is given. Others have contractual provisions that start the clock on service degradation. A few have been known to become actively obstructive — dragging their feet on documentation handover, delaying access transfers, or making themselves “unavailable” for knowledge transfer calls.
None of these things are insurmountable, but they are significantly easier to navigate when you have an incoming provider who is experienced with transitions and has a plan for dealing with resistance.
Check Your Contract First
Before anything else, read your current IT service agreement. Specifically, look for:
Notice period. How much advance notice do you need to give? Standard terms range from 30 to 90 days. Some contracts auto-renew annually and require notice before the renewal date to avoid being locked in for another year.
Data and documentation provisions. Does the contract specify that documentation, passwords, and system information are your property? If not, this becomes a negotiation point when you try to get access back.
Hardware ownership. If your provider supplied hardware (servers, switches, firewalls) as part of the service, clarify the arrangement. Is it leased? Purchased? Does it revert to them when the contract ends?
IP provisions. If the provider built custom scripts, configurations, or automation for your environment, who owns them?
Key point: Most IT service agreements are MSP-friendly by default. Your incoming provider can help you understand what you are entitled to — and what you may need to negotiate for.
Finding the Right Incoming Provider
Switching IT providers is only worthwhile if you are switching to something better. The selection criteria that matter most:
The 10 Questions to Ask Before Signing
1. What is your onboarding process? A provider with no structured onboarding process is a red flag. Onboarding is not just about collecting passwords — it is a knowledge transfer exercise that determines how well they can support you from day one.
2. How do you handle transitions from difficult outgoing providers? The answer tells you a lot. An experienced provider has been through adversarial transitions before and has processes for managing them.
3. What documentation do you produce and maintain? You should own a complete network documentation file covering every device, every account, every vendor relationship. Ask to see an example of what they provide clients.
4. What is your average response time for critical issues? Ask for actual data, not a promise. What does the SLA say, and do you have client references who can confirm it is met?
5. Who will be our primary contact? Will you have a named account manager and a named technical lead, or will you be in a pool of tickets handled by rotating staff?
6. How do you handle after-hours emergencies? What happens when your email goes down at 11pm on a Friday before a Monday pitch to a major client?
7. What security stack do you recommend and manage? A provider with no defined security practice is not managing your risk — they are just fixing things when they break.
8. Are your staff certified? Microsoft Partner status, CompTIA certifications, and ACSC partner status are minimum markers. Certifications do not guarantee competence, but their absence is notable.
9. What is your client retention rate? Providers confident in their service quality will answer this. Those who are not will deflect.
10. Can we speak with two or three current clients? Not a curated reference list — actual clients in businesses similar to yours. If they will not provide this, walk away.
The Four-Phase Transition Process
A well-run IT provider transition has four phases. Each phase has specific activities, responsible parties, and success criteria. The full checklist expands on every item below, but this is the architecture.
Phase 1: Discovery and Documentation (Weeks 1–2)
The incoming provider needs to build a complete picture of your environment before they take over responsibility. This phase happens while your current provider is still in place and — ideally — without your current provider knowing you are switching.
What gets documented:
- Every server, physical or virtual, with OS version, role, patch level, and hardware age
- Every network device (firewall, switches, access points) with firmware version and configuration
- Every endpoint (laptop, desktop, mobile device) enrolled in management
- Every Microsoft 365 user, licence type, and admin role
- Every line-of-business application with vendor contact, licensing details, and support arrangement
- Every third-party vendor relationship your IT provider manages on your behalf (internet provider, phone system, domain registrar, cloud backup vendor)
- Every scheduled task, automation, or process the current provider runs
This sounds like a lot. For a 20-person business, a thorough discovery typically takes 8–12 hours of technical work. For a 50-person business, 20–30 hours. It is not fast, but it cannot be skipped.
Critical note: The incoming provider should be able to do most of this discovery themselves from what they can access — Microsoft 365 admin centre, your firewall’s management interface, your IT asset management records. They should not need to ask your current provider for anything in phase one.
Phase 2: Access Transfer (Week 3)
This is where most transitions get complicated. Credentials, administrator access, and third-party account control need to transfer to the incoming provider — and often to you as the business owner first.
The essential handover list:
- Microsoft 365 Global Administrator account (in your name, with your email, using your phone for MFA)
- Domain registrar login (the account that controls yourcompany.com.au)
- DNS management access (often the same as the registrar, sometimes separate — e.g., Cloudflare)
- Business banking portal administrator access
- Cyber insurance portal access
- Internet service provider account management access
- Phone system administration access
- Any cloud backup management portal
- All IT asset serial numbers and warranty records
- Any hardware purchased by the provider on your behalf
The most critical of these is the Microsoft 365 Global Admin account. If your current provider maintains global admin control using their own accounts, you are at risk. You should have at least two Global Admin accounts that you personally control before you give notice. If your current provider resists this, escalate to Microsoft.
Script for requesting access from a resistant provider:
“We are conducting an internal audit of our IT access and governance. We need administrator accounts in our own name for our Microsoft 365 tenant, domain registrar, and internet service provider portal. Please provide these or assist us in setting them up. This is standard business practice and we will need this completed by [date].”
Frame it as governance and risk management, not as a sign you are leaving. You should have this access regardless.
Phase 3: Shadow Support (Weeks 3–4)
Before the cutover date, the incoming provider should be in a position to shadow your support environment. This means:
- They have all the documentation from Phase 1
- They have monitoring tools deployed on your key systems
- They are reviewing your environment and identifying issues proactively
- They can observe the volume and nature of support requests being handled
This phase builds familiarity. When cutover happens, the incoming provider is not walking into an unknown environment — they already have several weeks of observation and preparation.
Phase 4: Cutover and Hypercare (Week 4+)
The cutover should happen on a planned date, agreed by all parties, on a controlled basis.
Best practice for cutover day:
- Choose a Tuesday, Wednesday, or Thursday — never a Friday (you want a full week ahead of you for the first days)
- Begin with a technical handover call between outgoing and incoming providers (even if the relationship is poor, a brief handover call reduces risk)
- Redirect monitoring alerts, ticket routing, and emergency contact details
- Send an all-staff email introducing the new provider and providing the new helpdesk contact details
- The incoming provider should be available on-site or on immediate call for the first day
Hypercare (first two weeks):
For the first two weeks after cutover, the incoming provider should operate in hypercare mode:
- Faster response times than standard SLA
- Daily check-in call with your internal coordinator
- Proactive review of any open issues or backlog from the outgoing provider
- Documentation of anything discovered that was not known at cutover
Red Flags to Watch For
Hostile Documentation
Some providers treat the documentation they have created about your systems as their proprietary information. This is legally questionable — documentation created about your infrastructure belongs to you — but enforcing it can require legal pressure.
If your outgoing provider refuses to hand over documentation, the incoming provider may need to rebuild it from scratch. This takes longer but often results in better, more accurate documentation than what you would have received anyway.
Credential Lock
The Microsoft 365 tenant scenario is the most common. You discover at the last moment that the only Global Admin accounts in your tenant belong to your outgoing provider’s staff. They have leverage and they know it.
Prevention: address this in Phase 2 before giving notice, as described above. Cure: Microsoft has a process for business owners to recover control of their own tenant. It requires identity verification and takes 3–5 business days. Your incoming provider should know this process.
Short-Notice Offboarding
A provider who offers only a two-week transition window is not setting you up for success. Insist on 30 days minimum. If your contract specifies a shorter period, negotiate an extension in writing before giving notice.
The Guilt Trip
Some providers attempt to leverage personal relationships: “After everything we’ve done for you…” or “You’re going to struggle without us.” This is emotional manipulation, not a business argument. Your IT provider is a vendor. You are entitled to switch when it is in your business’s interest to do so.
The 30-Day Transition Checklist
The full checklist in this guide covers all of the above in task-by-task format, with:
- Week-by-week activity schedule
- Responsible party for each task (you, incoming provider, outgoing provider)
- Dependencies between tasks
- Completion criteria for each item
- A credential handover template
- A vendor contact template for every third-party relationship your IT provider manages
- A due diligence question set for evaluating incoming providers
- Sample scripts for requesting documentation and access
What a Good Transition Actually Costs
Most reputable MSPs offer a structured onboarding process at no charge as part of the agreement, because getting you onboarded correctly makes the ongoing relationship easier for both parties. What you should expect:
Free as part of onboarding:
- Discovery and documentation
- Microsoft 365 configuration review
- Network assessment
- Security baseline review
May involve a one-time fee:
- Remediation of issues discovered during assessment (aged equipment, misconfigured systems, security gaps)
- Hardware procurement if your current equipment is unsuitable or end-of-life
- Data migration if files need to move from one platform to another
Be wary of providers who charge significant upfront fees before delivering any value. A small discovery or assessment fee is reasonable; a large implementation charge before they have demonstrated capability is not.
After the Transition: Setting Yourself Up for Success
The transition is complete. Now the real work begins: building the kind of relationship with your IT provider where they function as a strategic partner rather than a reactive support desk.
Quarterly business reviews (QBRs): Request a formal quarterly review where your IT provider presents on the state of your IT environment, upcoming renewals, security posture, and any recommended investments. A provider who will not do QBRs is not managing your IT strategically.
Technology roadmap: Ask your new provider to develop a 12–24 month technology roadmap that connects IT investments to your business goals. This becomes the basis for IT budget conversations and prevents the reactive, expensive surprises that characterise poor IT management.
Security reporting: Ask for monthly or quarterly reporting on your security posture — patch compliance rates, MFA adoption, endpoint protection status, backup health. If they cannot provide this, you are not getting managed IT; you are getting break/fix with a contract.
Escalation path: Know the name and contact details of the person above your account manager. Relationships change — staff leave, businesses get acquired. Know who to call when the usual channels are not working.
The right IT provider should make your technology invisible: it just works, and when it does not, it gets fixed fast. If you are still fighting fires and chasing tickets eighteen months in, the problem is not IT — it is the provider.
CX IT Services manages IT transitions for Melbourne businesses as part of our structured onboarding process. Book a Right Fit Call to discuss your current situation and whether switching is the right move for your business.