IT Glue migration: moving documentation and passwords without exposing credentials

The dangerous file in an IT Glue migration is the password export, not the documents. Moving off IT Glue comes down to four steps: export documents, flexible assets and configurations per organisation, handle the credential export as a live security incident, restructure the content in the new system rather than copying it, then rotate and verify before you cancel. Documents are tedious. Passwords are the part that can hurt you. Here is how to do each, in order.

Start the IT Glue migration before the renewal notice period

Check your contract for the notice period and the date your access ends, then work backwards. You want the export finished, imported and checked while you still have a working IT Glue account to compare against, because once the account closes, a missing runbook is simply gone.

Run the migration as a project with an owner, a cut-over date and a list of every organisation. The same discipline applies to any platform change, and if you are moving your PSA at the same time, our guide to leaving ConnectWise Manage covers the billing side. If you are still choosing where the documentation goes, our comparison of IT Glue alternatives, including Hudu, is the place to start.

What to export, and in what form

IT Glue offers an account-level export from its admin area, and an API for anyone who wants finer control. Most small MSPs use the built-in export and accept some cleaning afterwards. Expect a set of files per organisation rather than one tidy database.

• Documents. These come out as HTML with their attachments. Formatting usually survives; embedded images and internal links between documents often do not. Skip checking these and you will discover broken runbooks during an outage.
• Flexible assets. Each flexible asset type exports as its own structured file, with one column per field. Related items and tags tend to arrive as names or IDs rather than working links, so plan to rebuild relationships by hand or by script.
• Configurations, contacts and locations. These are the easiest to map, and many destination tools can import them from CSV directly.
• Passwords. If you include them, they arrive readable. That is the whole problem, and the next section is about nothing else.

Handling the password export like the incident it is

An export containing every client credential in readable text is the most valuable file your business will ever produce. Treat it as one. A credential vault does not stop being a vault because you have unzipped it into a Downloads folder.

1. Export on one controlled machine. A managed, encrypted workstation, not a laptop that syncs to a personal cloud drive. Turn off folder sync for the working directory before you start.
2. Keep it out of email, chat and tickets. If the file has to move, use an encrypted container with the passphrase sent by a separate channel. Skip this and the credentials now live in a mailbox archive for years.
3. Import straight away. The file should exist for hours, not weeks. Every day it sits on disk is a day it can be backed up, copied or forgotten.
4. Delete deliberately. Remove the file, empty any recycle bin and check that your backup tool did not capture the directory. Write down that you did it, and when.
5. Limit who touches it. One or two named people, not the whole team. Fewer hands means a shorter list of places to check later.

Then do the part most migrations skip: rotate the credentials that matter most. Global admin accounts, domain admin, firewall and backup consoles at minimum. An export, however carefully handled, is a copy you cannot fully account for, and rotation is the only thing that makes the old copy worthless. It is also a good moment to retire shared accounts nobody can explain.

The safest credential export is one that is out of date by the end of the week.

Restructure the documentation, do not just copy it

A straight lift-and-shift reproduces every bad habit IT Glue let you accumulate: three flexible asset types that mean the same thing, documents titled "New Document (2)" and runbooks for servers decommissioned years ago. Documentation estates collect dead pages the way spare rooms collect chairs.

Decide the structure before you import

Write down the handful of record types you actually use: network, Microsoft 365 tenant, line-of-business apps, backup, onboarding and offboarding. Map each IT Glue flexible asset type to one of those, or mark it for deletion. Anything that maps to nothing is a candidate for the bin.

Standardise one client properly first

Migrate one representative organisation by hand and fix the template until a technician who has never seen that client could use it during an outage. Then apply that structure to everyone else. This is slower for a week and much faster for the life of the tool.

Archive rather than migrate the long tail

Old documents that nobody has opened in a long time do not need to be rebuilt in the new system. Keep a read-only archive of the full export, encrypted and with passwords removed, so you can retrieve something if an auditor or client asks, and leave the clutter behind.

How IT Glue migrations usually go wrong

• The forgotten export file. A copy of every client password sits on a desktop for months. The fix is the delete-and-record step above.
• Broken relationships. Assets import, but the links between a server, its backup job and its runbook do not. Check relationships, not just counts.
• No rotation. The move is clean, yet the old credentials stay valid indefinitely.
• Cancelling too early. Access ends before anyone has compared the new system with the old one.

Where this fits with Helios

Helios is an RMM and PSA platform that includes IT documentation alongside monitoring, patching and the service desk, so client documentation can sit next to the devices and tickets it describes, whether the machines belong to clients or to your own company. Most of this guide is discipline, not tooling: no platform will rotate your domain admin password or delete a forgotten export for you. If you want documentation in the same place as the rest of your stack, every feature is on every plan with no charge per technician, and the pricing page sets out what that costs for your fleet.

Common questions about an IT Glue migration

Does the IT Glue export include passwords in plain text?

When you choose to include passwords in an IT Glue export, they arrive in readable form so that another system can import them. That is why the export file should be created on one controlled, encrypted machine, imported quickly, deleted on purpose, and followed by rotation of the most sensitive credentials such as admin, firewall and backup accounts.

How long does an IT Glue migration take for a small MSP?

An IT Glue migration for a small MSP depends mostly on how messy the documentation is, not on the export itself, which is quick. Restructuring flexible assets, rebuilding relationships and checking each organisation is the slow part. Start well before the renewal notice period so the old account is still available for comparison.

Should flexible assets be migrated as they are?

Flexible assets from IT Glue are better mapped onto a smaller, agreed set of record types in the new documentation tool than copied one to one. Copying them as they are tends to carry over duplicate asset types and stale records, while mapping them forces a cleaner structure that technicians can actually navigate during an incident.

Researched and written with Helio SEO, our AI writer for business blogs.