Defend
Changing provider
Old access doesn’t leave by itself. When you move to us, every way the previous provider had into your firm is found, removed and ticked off in a written check that your firm keeps.
Old access doesn’t leave by itself.
A provider that ran your IT for years has keys everywhere: admin accounts in your directory and your Microsoft 365, the sync between the two set up under its own account, delegated access to your tenant through its own portal, group policies that quietly install its tools, and an agent on every laptop and server that lets it in. On the day you change provider, none of that goes away on its own. Most of it isn’t malice; it’s leftovers. But a leftover admin account is a way in, for whoever gets hold of its password later. So a takeover with us ends with a written check: every way in, found and removed, each with a date and the proof. Your firm keeps the list.
The check
Every way in, found and closed.
The list below is the check, in the order we work through it. Each line is done when it’s proven done, not when someone says so.
-
Admin accounts
Every admin account in your directory and in Microsoft Entra ID that isn’t one of your named people or ours: removed. The admin access, the tenant and the documentation belong to your firm; if you ever leave us, you leave with all of it.
-
The directory sync
The sync between your office directory and Microsoft 365 is checked for whose account it runs under and who is signed in to its setup. It’s moved to an identity your firm owns, and the old provider’s admin is taken out of it.
-
Delegated admin
Access to your tenant through the old provider’s own portal, which doesn’t show up as an account in your directory, is found and withdrawn, and the withdrawal is cross-checked by us, not taken on trust.
-
Group policies
Every policy in your domain is listed, by script, not by clicking through. The ones that install the old provider’s tools or map its drives are removed; the rest are read and kept only on purpose.
-
Agents on every laptop and server
The old provider’s remote-management, monitoring and documentation agents are removed from every device, once ours are in place. A script reports first and removes second, and every removal is logged with its date.
-
Passwords, subscriptions and the firewall
Every shared password the old provider knew is changed. Cloud subscriptions, licences and domains are moved into your firm’s name. The firewall and remote access get admin credentials your firm controls.
On record
In your evidence file.
- The checklist: every way in, with the date it was closed and the proof
- Who holds admin rights after the takeover, by name
- Which agents were removed from which devices, with dates
- What your firm now owns in its own name: tenant, subscriptions, domains, licences
Written as each line is done, so the check is a record, not a reassurance.
What usually goes wrong without it.
-
The admin account nobody looked for
Months after the change, the old provider still holds an admin account, and the directory sync still runs under one of its logins. Nothing was hidden; nobody looked.
-
Removed on paper
The old provider confirms it has taken its access out. Nobody cross-checks it against the tenant and the domain, so a policy that installs its tools keeps running.
-
The agent that came back
The old provider’s agents were removed from every laptop. One hook nobody had found brought one back, and nobody noticed, because nothing was watching for it.
Also under Defend
- Email security Spam, phishing and malware filtered out before a mail reaches anyone, with long-term archiving.
- Multi-factor sign-in A second factor for every account, so a stolen password on its own opens nothing.
- Conditional access Who is signing in, from where and on which device, checked every time.
- Device protection Managed protection and threat detection on every laptop, workstation and server, to a documented baseline.
- Patching and vulnerability management Updates rolled out from one place, and the gaps that remain found and closed.
- Admin access Admin rights for few, by name; passwords in a vault; every use logged. Our own keys first.
- Backups and restore tests Backed up, restored on purpose before you need it, dated, and kept for the years you’re bound.
- Security monitoring Devices, sign-ins and systems watched centrally; what the monitoring found, reviewed by our engineers, and what we changed.
- Access reviews Who can open what, reviewed with you, so access that made sense last year doesn’t quietly stay.
- Incident response When someone clicks, or a server shows a ransom note: the same sequence every time, ending in the record.
- The evidence file What protects your firm, written down as it is, ready on the day an insurer, a client or an auditor asks.
- Insurer and client questionnaires Your insurer’s and your clients’ security questionnaires, answered with what’s true today, the gaps closed before renewal.
Questions we get
We parted with our old provider on good terms. Do we still need this?
Yes, and it’s easier then. Most leftover access isn’t malice, it’s what nobody thought to remove. A friendly provider hands over what it has, and the check confirms it. Either way your firm ends up with a list it can show an insurer or a client.
What if the old provider won’t cooperate?
Then the order matters: domain and DNS, your own global admins, licences, your own backups, the firewall and remote access, then its agents and shared passwords. Our guide on changing provider when the old one won’t cooperate sets it out, and it’s the order we work in.
Does the same check apply if we ever leave you?
It does, in reverse. Your tenant, your files and the admin access belong to your firm. If you leave us, you leave with all of it, documented, and we take our own access out the same way, with the proof.
Start
Who still has a way into your firm?
In a first call we go through who holds admin rights at your firm today, which agents are on your devices, and what a written check would find.
- No first level
- No surprises
- Pilot before you buy