How do I take over a client from another MSP?
On this page
Have the practice owner, not you, request every credential in writing; secure owner-held admin access to Microsoft 365, the domain and the firewall first; then rotate, document and remove the old provider's access. Registrars must release a domain's transfer code within 5 calendar days (ICANN). Plan the 2026 handoff in that order.
Key facts
| Item | What the source says | Source |
|---|---|---|
| Who decides on a domain transfer | The Registered Name Holder's authority supersedes the Administrative Contact's | ICANN Transfer Policy |
| Transfer code | Registrar must provide the AuthInfo code within five calendar days of the holder's request, if it doesn't offer self-service | ICANN Transfer Policy |
| Transfer timing limits | A transfer can be denied within 60 days of creation or of a prior registrar transfer | ICANN Transfer Policy |
| Microsoft 365 partner roles | The customer can remove a partner's admin roles at any time | Microsoft Learn |
| Withholding PHI access | A business associate may not block access to PHI to resolve a payment dispute | HHS FAQ 2074 |
| At termination | BAA must require return or destruction of PHI, if feasible | 45 CFR 164.504 |
| Old accounts | Identify and disable accounts no longer in use | CISA AA22-131A |
Why should the practice make the requests, not the new MSP?
Because the accounts belong to the practice, and the outgoing provider owes the practice, not you. A request from the owner carries contractual weight and, for PHI systems, HIPAA weight: HHS says a business associate may not block a covered entity's access to PHI, even over a billing dispute (HHS FAQ 2074). A request from you is just a competitor asking for keys.
Draft the letter for the doctor. Keep it civil, specific and dated. ITS, an MSP that has written on the topic, advises keeping things civil and bringing in your legal team if a dispute can't be solved amicably (ITS). The doctor-side version of this process is in how to switch dental IT providers.
What's the handoff order?
Secure the systems that control everything else first. Lose the domain or the Microsoft 365 tenant and every other credential can be reset out from under you.
| Order | System | Goal before cutover |
|---|---|---|
| 1 | Domain registrar and DNS | Practice is registrant; owner can log in; transfer code obtained if moving registrar |
| 2 | Microsoft 365 or Google Workspace | Two emergency admins, one owner-held (Microsoft Learn) |
| 3 | Firewall and remote access | Owner admin plus your named admin; old VPN accounts removed |
| 4 | Backups | Practice-owned console; a test restore before you rely on it |
| 5 | PMS and imaging server | Practice admin; vendor support contacts updated |
| 6 | Switches, Wi-Fi, NVR, phones | Admin access, configs exported |
| 7 | Workstations and servers | Local admin rotated; old RMM agent removed |
| 8 | Licenses and subscriptions | Registered and billed to the practice |
Step by step
1. Inventory before you ask
Walk the office and build the asset list from what's physically there, not from the old MSP's records. Use the HHS 405(d) inventory fields (HICP Technical Volume 1) and the method in how to document a dental client's network. Your request letter should list every system by name.
2. Domain first
Confirm the practice is the registrant. ICANN's Transfer Policy says the Registered Name Holder's authority supersedes the Administrative Contact's in a dispute, and registrars must provide the AuthInfo code within five calendar days if the holder can't generate it themselves (ICANN Transfer Policy). If the old MSP is listed as registrant, fix that before anything else.
3. Microsoft 365 tenant
Get owner-held Global Admin. Then, from Partner relationships, the customer can remove the old partner's admin roles at any time (Microsoft Learn). Set up your own access through GDAP, which is least-privileged, time-bound and must be granted by the customer (Microsoft Learn).
4. Firewall, VPN and remote tools
Change every admin password, remove the old provider's VPN and named accounts, and uninstall their remote-monitoring agents. CISA tells MSP customers to identify and disable accounts no longer in use and to enforce MFA on MSP accounts (CISA AA22-131A).
5. Backups and data
Confirm where every backup lives and who holds the encryption key. Run a restore. HHS 405(d) notes that MSP vendor management doesn't end at termination: the contract should cover eliminating and documenting all access to patient information and returning or destroying it (HICP Technical Volume 1). The BAA must require return or destruction of PHI at termination, if feasible (45 CFR 164.504). Get that certification in writing.
6. Paper the change
Sign your BAA and service agreement before you touch PHI systems (BAA with your dental IT company). Update vendor support contacts at the PMS and imaging companies.
What if the old MSP won't cooperate?
Escalate in writing, from the practice, citing the contract and HHS's position on PHI access (HHS FAQ 2074). Meanwhile, recover what the practice can through platform owner processes; for the domain, that means the registrar's own registrant procedures. See can my IT company refuse to give me my passwords?. This is general information, not legal advice; a stalled handoff involving PHI is the moment for the practice to call its attorney.
Which free tools help with this?
The credential ownership checklist (free tool, coming soon) is planned to list every login, license and account the practice should own, with a "password hostage" letter template. The network & IT plan generator (free tool, coming soon) is planned to turn a floor plan into a network, drop and rack plan. FloorStack Studio (live, free plan) places every device on your floor plan and gives you a device schedule with rooms, ports and cable lengths (FloorStack FAQ).
How FloorStack helps
FloorStack is a dental build-out platform designed so the next handoff is a click, not a standoff. The practice's logins live in its own vault, stored per device; the owner grants your access, can revoke the old provider's, and sees every view in the audit log (FloorStack). Map the inherited office in Studio (live, free to start), use the free Credential ownership checklist (coming soon), with its "password hostage" letter template, for the owner's request, and use the free Network & IT plan generator (coming soon) to redraw the network map. Visit the Own Your Dental Passwords hub.
Free tools for this step
- Credential ownership checklist: system list plus "password hostage" letter template (free tool, coming soon).
- Network & IT plan generator: rebuild the network map (free tool, coming soon).
- Studio: map the inherited office (live).
Frequently asked questions
Should I contact the old MSP directly?
Coordinate technical details with them, but credential requests should come from the practice owner in writing.
What's the first system to secure?
The domain. Then Microsoft 365 or Google Workspace, because most other resets flow through email.
Can the old MSP keep a copy of patient data?
Their BAA must require return or destruction at termination where feasible (45 CFR 164.504). Ask for written certification.
How do we remove the old partner from Microsoft 365?
The customer can remove partner admin roles at any time from Partner relationships (Microsoft Learn).
Can a registrar block a domain move?
In listed cases, including within 60 days of creation or a prior registrar transfer (ICANN Transfer Policy). Plan registrar moves around that window.
How long should overlap with the old MSP last?
Only as long as it takes to verify every credential and a backup restore. Then remove their access the same day.
Sources
- FloorStack: Frequently asked questions
- ICANN: Transfer Policy
- Microsoft Learn: Manage partner relationships
- Microsoft Learn: Granular delegated admin privileges (GDAP) introduction
- Microsoft Learn: Manage emergency access admin accounts
- HHS FAQ 2074: May a business associate block or terminate access to PHI?
- 45 CFR 164.504, Uses and disclosures: organizational requirements (LII)
- CISA et al., Advisory AA22-131A: Protecting Against Cyber Threats to MSPs and their Customers
- HHS 405(d): HICP Technical Volume 1 (PDF)
- Intelligent Technical Solutions (ITS): Can an IT Company Withhold Your Login Credentials?
- FloorStack home page
More in Own Your Dental Passwords
- Dental IT Contract Clauses: Own Your Passwords and Data (2026)What a dental IT contract should say in 2026 about passwords, admin accounts, data return and offboarding, so your practice is never held hostage.6 min read
- BAA With Your Dental IT Company: What It Must CoverDoes your dental IT company need a BAA? Yes, if it can access ePHI. What a 2026 BAA must cover under 45 CFR 164.504 and 164.314, plus terms worth adding.5 min read
- Who Owns Your Dental Office Passwords and IT Accounts?Your practice owns its passwords, domain and admin accounts, not the IT company that set them up. See what HIPAA requires in 2026 and how to take inventory.6 min read
- Can Your IT Company Refuse to Give You Your Passwords?An IT company holding your patient data can't lock you out over a billing dispute, HHS says. What to do in 2026 if your dental IT provider withholds access.6 min read
- How to Switch Dental IT Providers Without Losing Access (2026)A 2026 step-by-step plan for switching dental IT providers: inventory, owner admin accounts first, credential handover, BAA data return, and a 30-day checklist.6 min read
- Is Your Dental Equipment Registered to You? How to Check and Fix ItCheck who your dental equipment is registered to in 2026: x-ray state registration, warranty invoices, software licenses and vendor portals, and how to fix it.5 min read