MSP client handover: passing on credentials, documentation and agents cleanly

Handing a client over cleanly means four things done in order: transfer and then rotate every credential, export the documentation in a format the next provider can read, remove your agents and access once the new provider is in place, and close billing with one final, itemised invoice. An MSP client handover goes wrong when those steps overlap or happen out of sequence. Here is how to run each one, whether the client is leaving you or you are passing them on.

Why the handover deserves its own plan

Offboarding is often treated as an admin task: switch off the contract, stop the invoices, move on. The handover is the part where that attitude causes damage. You hold the keys to someone else's business, and for a few weeks two parties may hold them at once.

The goal is simple to state. On the day you step away, the client should have full control of everything, the new provider should have what they need, and you should have nothing left. No admin account, no remote tool, no vault entry. Anything less is a liability you are carrying for free.

The cleanest handover is the one where, a month later, nobody can find a trace of you.

Credential transfer: hand over, then rotate

Credentials are the riskiest part of any MSP client handover, because a password you passed on is still a password you know.

• Inventory first. List every account you administer or hold: Microsoft 365 global admins, domain registrar, DNS host, firewall, Wi-Fi controllers, backup consoles, line-of-business apps, vendor portals and break-glass accounts. Skip this and you will discover the forgotten one when it expires.
• Transfer to a named client owner. Ownership goes to someone at the client, not straight to the incoming provider. The client then grants the new provider access on its own terms.
• Use a secure channel. A vault-to-vault share or an expiring encrypted link, never email or a spreadsheet. Our guide to moving documentation and passwords without exposing credentials covers the mechanics.
• Rotate after the transfer. Once the client confirms access, change every shared password and remove your own accounts and delegated admin relationships. In Microsoft 365, that includes partner relationships and any app registrations you created.

Documentation export: readable without your tools

Your documentation platform is not the client's. An export that only makes sense inside your tool is a box of parts with no instructions.

• Export to open formats. PDF for narrative documents, CSV for asset lists, configurations and licence records. The next provider may use a completely different system.
• Include the network picture. IP ranges, VLANs, firewall rules, VPN configuration, DNS records and diagrams. These are the things that take days to rediscover.
• Record the quirks. The printer that needs a static address, the app that breaks on a certain update, the server nobody reboots on a Monday. Tribal knowledge is the most valuable and least exported part of most documentation.
• Hand over scripts and policies. Patch rings, monitoring thresholds and custom scripts tell the next provider how the estate has been run. If you need to pull those from your RMM, see how to export RMM scripts before you cancel.
• Strip your own material. Remove internal pricing notes, other clients' references and anything about your business that does not belong in theirs.

Ask the client to confirm receipt in writing. A dated acknowledgement settles any later argument about what was handed over.

Agent removal: last in, last out

The temptation is to uninstall your agents the moment notice is served. Resist it. Removing monitoring before the new provider has deployed theirs leaves machines unpatched and unwatched, and that gap belongs to whoever caused it.

1. Agree a cut-over date. Your agents stay until the incoming provider confirms their own agents are reporting on every device. A short overlap is normal and usually safe.
2. Remove everything you installed. RMM agent, remote access tool, any endpoint or backup agents licensed under your accounts, and scheduled tasks or services your scripts created.
3. Verify from the outside. Check your console shows the devices offline, then delete the client's site so nothing reconnects by accident.
4. Deal with licences you own. Security and backup licences on your distributor account must be transferred or replaced before you cancel them, or the client is suddenly unprotected.

Whether the machines belong to a client or to your own company, the principle is the same: protection should never drop to zero during the swap.

Final billing: one invoice, no surprises

The last invoice is the client's final impression of you. Make it boring.

• Check the contract terms. Notice period, end date and any agreed handover fee or hourly rate for exit work.
• Itemise the exit work. Time spent on exports, credential transfer and agent removal should appear as named lines, matched to tickets.
• Stop recurring charges on the right date. Remove the client from recurring billing in your PSA and accounting system together, so neither generates a stray invoice next month.
• Settle third-party licences. Credit or recharge any licences you were reselling, prorated where the contract allows.

Failure modes compared

Where this fits with Helios

Most of a handover is discipline, not tooling. Helios helps with the parts tooling can carry: documentation and credentials live alongside the devices they describe, exit work is logged against tickets in the service desk, and time flows into billing in Xero or QuickBooks so the final invoice matches the work. Every feature on every plan, so the export and billing tools are there whichever plan you are on.

Common questions about MSP client handovers

Should an MSP charge for a client handover?

An MSP can reasonably charge for client handover work if the contract allows it, because exports, credential transfer and agent removal take real technician time. The fairest approach is to agree an exit rate or fixed fee in the original contract, then itemise the hours against tickets on the final invoice so the client sees exactly what was done.

Can an MSP refuse to hand over passwords until the bill is paid?

Withholding admin credentials over an unpaid bill is risky for an MSP, because the client owns its systems and data, and blocking access can expose the provider to legal and reputational trouble. Pursue the debt separately through normal channels, and take advice on your contract terms before treating credentials as leverage of any kind.

How long should a client handover take?

A client handover usually takes as long as the incoming provider needs to deploy its own tools and confirm access, plus time to export documentation. For a small estate that might be a couple of weeks; complex networks take longer. The notice period in the contract sets the outer limit, so start planning on the day notice arrives.

Researched and written with Helio SEO, our AI writer for business blogs.