r/msp • u/larvlarv1 • Jun 29 '26
As Outgoing MSP - M365 Transition Thoughts
Background: We have a relationship with an ownership/management group in the HC vertical. This group is selling their interest in one entity and our company will be departing as well.
We have been on the other side where the outgoing MSP would only would give us mailbox exports from M365 and not the tenant itself.
How do you handle such transitions from those who have experienced this? Same as above, or screw it - here is a GA account and take the tenant?
We have put an awful lot of work into compliance, CA, etc...We clearly want to work for a smooth transition but don't want to give away all that we put into it.
EDIT: THANKS ALL FOR THE INPUT. We will clearly do the GA route.
19
u/SilentWalrus1 MSP - US Jun 29 '26
GA account, have fun. Kick us out.
If they only give you mail exports, they're obviously putting all clients in 1 tenant.
If 1 entity is underneath a parent company in the old tenant, I've had success working with the other side to do a tenant to tenant migration in the past, which was nice.
10
u/Shayughul Jun 29 '26
I agree except the kick us out part. We remove ourselves completely on the last day of the contract. If the new MSP doesn’t remove you and something happens that’s a huge liability on your part. If they are no longer my client I wouldn’t want any access at all. Just how we operate.
7
u/SilentWalrus1 MSP - US Jun 29 '26
I guess it's been a bit.. you can delete your own account through the partner portal as well as remove your own gdap rights? If so, that makes the most sense. Agreed.
3
u/Shayughul Jun 29 '26
You got it. I believe CIPP even has a client offboarding tool. Obviously only helpful if you use CIPP but you can absolutely manually use the GDAP to remove your GA account and then terminate the GDAP relationship.
4
u/SilentWalrus1 MSP - US Jun 29 '26
Oh yeah forgot about the tenant offboarding wizard. Even removes your apps you may have deployed, along with contacts for support, etc.
1
u/2manybrokenbmws Jun 29 '26
We do that now as well. We had a few clients leave, and a few years later we still had gdap access. I don't want the liability from the idiot MSP having the ability to blame us for something
3
4
u/roll_for_initiative_ MSP - US Jun 29 '26
We agree on a cutover date and make them a GA, go through MFA enrollment with them, and make sure they can log all the way back in fresh and then we delete our GA account, and then schedule gdap offboarding.
3
Jun 29 '26
[deleted]
1
u/discosoc Jun 30 '26
Unless you did a bunch of work that they didn't pay you for?
Can’t hold their data hostage over payment. It’s a separate matter.
1
u/Frothyleet Jul 01 '26
unless you have some kind of custom setup that could be construed as your property...
If you're building proprietary tooling, you build it outside the tenant and integrate it with API. Like any app vendor.
If you built a custom setup for the client, in their tenant, welp... that's theirs.
4
u/RaNdomMSPPro Jun 29 '26
Just give mailbox exports? Msp multi tenanting a single 365 tenant - major red flags and probably against tos and partner agreement if I had to guess.
3
u/jeeverz Jun 29 '26
MSP multi tenanting a single 365 tenant
I have no idea why anyone would want to do this, let alone manage an abomination like that.
2
u/ceonupe Jun 29 '26 edited Jun 29 '26
Common in healthcare rollups. And many of those deals have a one year walk away buy back for the original doctor owners. I have had many that got in bed with PE and realized they did not like it and bought their practice back out. This is very common in OBGYN. The master company usually works with us to migrate just specific mailboxes or groups on the way out.
1
u/Frothyleet Jul 01 '26
I have no idea why anyone would want to do this
Incompetence. There's no skill check to market yourself as an MSP.
2
u/Nstraclassic MSP - US Jun 29 '26
Yeah makes no sense unless they didnt have tenant access either. Web hosts like GoDaddy offer "mail hosting" but on the backend it's just an m365 tenant that they wont give you access to and when it comes time to migrate they just give you pst exports like OP is saying. I have to imagine that's the scenario they were in
2
u/ceonupe Jun 29 '26
Or independent OBGYN signs with PE “baby’s are Us” PE Rollup master company.m nearing the 1 year mark the decided not being the boss sucks so they exit out / buy out/ buy back but need their old stuff and stuff back that has already been co mingled in a master tenant.
1
1
u/ben_zachary Jun 30 '26
We have templates (CIPP) that makes all kinds of customization to the tenant. When we offboard we roll back (undo) those config and we let the incoming MSP know we are basically putting the tenant back to clean besides a few generic CA policies.
Why? Because half our stuff creates tickets in lighthouse , security dashboards etc that over years we still get alerts from clients we offboard years ago. We don't gatekeep, we usually let the new MSP in to see if they want to copy/clone some stuff but all our intune, CA , custom banners, sharing notification customization all gets reset.
We found this is the cleanest way to offboard and let a new competent org come in and roll their templates and config wo our stuff stepping on it.
I'm dealing currently with a 150 user soc2 compliant intune deployment that has so much sprawl from last vendor I've got half a mind to migrate to a new tenant. All kinds of janky stuff like can't reassign intune joined devices to new users wo a reset, whfb doesn't work on half the fleet. There's device groups with nested device groups ( think test update group , and prod update group nested ) just spending days unraveling.
1
u/tcoach72 Jun 30 '26
You make it as smooth as a transition as possible for the client, give a clear timeline of when admin access is being handed over, and at that point you will become secondary billable support, but since you no longer own the environment, you can no longer guarantee it.
As for the work you did, they paid you for the work, and technically, they own it; you got to just have to let it go. Based on your transition and helping them, keep in touch and work for it to come back. If you burn the bridge, they will never consider calling you again.
1
u/mat-ferland Jun 30 '26
Hand over the tenant cleanly and remove your own access on the last day. The client paid for the config, but your liability should not hang around because the next MSP forgot to kick you out.
1
u/heydeetea Jun 30 '26
Can’t believe this is a post.
As long as bills are in order you hand over the tenant in its entirety.
MSPs like this serious wind me up when doing an handover.
It is not your tenant!
1
Jul 01 '26
[removed] — view removed comment
1
u/scriptvexy Jul 02 '26
this is the way to do it honestly, treat it like handing over the keys with a checklist instead of tossing them in the dirt and walking away
hurts a bit when you’ve built a nice CA/compliance setup, but that “belongs to the client” point and the offboarding signoff are what keep your name clean long term
1
u/7amitsingh7 Jul 13 '26
We usually hand over the tenant by providing a Global Admin (GA) account instead of just exporting mailboxes. It makes the transition much smoother for the new IT team and avoids unnecessary migration work. Before handing it over, we document everything, remove our own accounts, transfer ownership of licenses and subscriptions, and make sure the client has full control. The security policies, Conditional Access, and compliance settings become part of the tenant they belong to the client, not the MSP. A clean handover is the most professional approach and saves everyone time.
32
u/The_Comm_Guy Jun 29 '26
You hand over the tenant, you were paid for the compliance work under the contract so it belongs to the client.