Switching Dealership IT Providers: A Transition Checklist

To switch dealership IT providers safely, read your contract’s exit terms, get every admin login and document into your hands, tell each vendor who’s taking over, and shut off the old provider’s access only after the new team is running.

Last updated: November 10, 2026

Who has the global admin login to your Microsoft 365? Ask it at your next managers’ meeting. If the room goes quiet and somebody offers to check with the controller, that’s your answer.

Microsoft’s own role documentation says “Global Administrators can reset the password for any user and all other administrators.” Sales manager to porter, that’s everybody. So if the honest answer is “our IT company,” you aren’t ready to switch yet. Doesn’t matter how unhappy you are with them.

“We already have an MSP” is something we hear from dealers. If you like yours, that’s fine. This post is for the ones who don’t. You’ve decided to move, and you want to do it without the sales floor noticing. If you’re still deciding what kind of provider to move to, start with how a generalist MSP compares with a dealership IT provider.

Bias disclosed: we benefit when you switch to us. But I’ve seen it from the other side too. We keep 98% of our clients, and when one does leave, the reason tends to be the one I’ve put this way before: “Once we get the plane in the air, we make it look easy.” They think they can do it cheaper or differently. So I’ve watched dealers switch to Helion’s managed IT for dealerships and I’ve watched a few switch away. The checklist doesn’t change.

Before You Give Notice, Read the Contract You Already Signed

Notice period. Renewal date. Who owns the firewall. Your monthly IT number, you know to the dollar. Those three? Go look.

Pull the agreement and the last 12 months of invoices before you say a word to anyone. Then go through it:

• Term and renewal. Does it roll over on its own if nobody sends a letter? Find the date. Put it on the controller’s calendar.
• Notice period. Thirty days, 60, 90?
• Do they make you buy all your hardware and software through them? Then look for the markup. Is it written down, or does the price just show up on the invoice?
• Is any of your equipment leased from the provider? Find out which pieces go back when you leave.
• Every store covered. Including the one you’re buying next year.
• Handover. Does the contract say they’ll hand over the passwords and the paperwork when you go? In writing?
• Early termination fees, and what triggers them.

On contract length, I’ll repeat what I said on a recent planning call with my team: “The longer the contract, the more you’re stuck.” Ours is two years. In the same conversation I said, “Two years is just long enough that we can plan and have the right staffing, but it’s not so long that we can get comfortable and feel like, oh, we can treat you however we want to treat you.” I meant it.

Read the purchasing clause twice. Does it require you to buy all your hardware and software from them? Then look for the margin. I said it on that same call: “So there’s no definitions of what the margins are or anything like that. So I don’t know why you’d ever want to commit to something like that.”

Government cybersecurity agencies say the same thing in drier language. A joint advisory that CISA, the NSA, and the FBI wrote with agencies in four other countries tells customers to “Ensure MSP-customer contracts transparently identify ownership of ICT security roles and responsibilities.” It also says providers should explain “services the customer is purchasing, services the customer is not purchasing, and all contingencies for incident response and recovery.” If your contract can’t answer those, you’ve learned something. Our dealership IT RFP template asks the next provider what the monthly number covers, and whether you get every password, admin login and document back when you leave, with the contract saying so.

Read it before you give notice.

What Should You Collect Before the Old Provider Knows You’re Leaving?

Collect anything a stranger would need to run your network without calling your current provider: the top-level admin logins, the documentation, and proof your backups restore. Ask for it in the normal course of business, like an annual review or an insurance renewal, before notice goes out.

Start with the one that worries me most.

1. Microsoft 365 global admin. Is there one in an account your dealership owns? Microsoft’s own documentation says “It’s important to prevent accidentally locking yourself out of your Microsoft Entra organization,” and tells you to create two or more emergency access accounts. Do you have even one?
2. Your domain. Find out who the registrar is and whose name is on the account. If it’s the provider’s, ask them to move it to yours.
3. Get the firewall login. Ask for an export of the configuration while you’re at it.
4. Internet circuits, store by store. Get the account numbers and circuit IDs, then look at who’s listed as the authorized contact. Does that person still work for you?
5. Count your devices. Yourself, if you have to, and don’t skip the laptops in the shop.
6. Backups. When did somebody last restore one? Ask for the date.
7. Are your Microsoft licenses billed through the provider’s partner account? Find out now.
8. Ask for the network diagram. You may get a blank look.

Now multiply that by your rooftops. Four stores can mean four sets of circuits, four closets, and four firewalls that were each set up a little differently by whoever was on the job that year.

On the licensing question, look at what your provider can reach inside your Microsoft 365. Here’s what Microsoft’s partner documentation says about granular delegated admin privileges:

“Customers manage rights and permissions to their Microsoft 365 accounts on the Partner relationships page in the Microsoft 365 Admin Center. On this page, customers can: See which partners they have a relationship with, and which partners have GDAP. Remove a partner’s GDAP from their tenant.”

So you can check it, and take it away on your schedule instead of theirs.

Most of this should be in your files already. We made that case in keeping IT documentation in systems, not in your IT person’s head.

If they won’t hand it over, that tells you plenty.

The Vendor Contact List Nobody Builds Until It’s Too Late

Does your DMS rep know you changed IT companies? Does the phone carrier? Not unless somebody told them. If your old provider is still the IT contact on their account, and the shop’s diagnostic connection drops two weeks after the switch, that’s who they’ll call.

The CISA advisory makes a version of this point, too: “Customers should review and verify all connections between internal systems, MSP systems, and other networks.” Every vendor on that list is one of those connections.

So build one sheet. Put every vendor and every store on it, with the account number, the support line, and the person at your dealership who can approve changes. Our dealership IT vendor inventory worksheet has the columns ready. Skip it, and you’ll have two IT companies each figuring the other one made the call, with your controller stuck in the middle. That’s finger-pointing. Nobody owns it.

Make the calls before cutover day.

How Does a Cutover Run Without Stopping the Sales Floor?

Do it in order: check what’s really installed, run the new tools beside the old ones for a short overlap, change every credential, shut off the old provider’s access, and then test every store before anybody calls it finished.

If I were in your seat, I’d have somebody from the new provider walk every store, every closet, and the service drive with the old provider’s paperwork in hand, because if things got added and moved over the years without anybody writing it down, the paperwork won’t match what’s on the wall. There may be a stretch where both providers have access while the new team gets its monitoring and security tools running next to the old ones. I’d keep it short and put the end date in writing, and while both are in, the advisory’s line applies to each of them: “Enforce MFA on MSP accounts that access the customer environment and monitor for unexplained failed authentication.” Then I’d change the passwords, every one the old provider knew, including the shared accounts people get nervous about touching, and then take their access off: remote tools, admin accounts, the partner relationship in Microsoft 365. Then test it the way your people will on Monday morning, which means a diagnostic in the shop, a deal printed in F&I, and a call to the main line at every rooftop. Leased gear goes back last. Somebody checks the final invoice against the contract, too.

Turning off the old access is the step that slips. Here’s the passage from that joint advisory on managed service providers, word for word:

“Both MSPs and customers should periodically review their internet attack surface and take steps to limit it, such as disabling user accounts when personnel transition. … Customers should be sure to disable MSP accounts that are no longer managing infrastructure. Note: disabling MSP accounts can be overlooked when a contract terminates.”

Picture that. You let a company go, and it can still log in to your network as an admin, and nobody’s watching. That’s a real problem.

Is there a compliance reason too? Yes, though I’d put it second. If you’re a covered dealership, here’s what the FTC Safeguards Rule says, at 16 CFR 314.4(f):

“Oversee service providers, by: (1) Taking reasonable steps to select and retain service providers that are capable of maintaining appropriate safeguards for the customer information at issue; (2) Requiring your service providers by contract to implement and maintain such safeguards; and (3) Periodically assessing your service providers based on the risk they present and the continued adequacy of their safeguards.”

A switch touches all three. Treat the old provider the way you’d treat an employee who just quit, which is what our employee offboarding checklist covers.

And if your IT manager is staying, lean on them, because they know where the mystery switch is. That’s what co-managed IT is for: your person keeps their role, and the provider adds depth in cybersecurity and compliance.

Access comes off last. All of it.

How Long Does Switching IT Providers Take?

Thirty days to six months. Can I narrow it? Not without seeing your stores, and I’d be wary of anybody who says they can. Onboarding starts within weeks of signing. Where you’re starting from decides the rest.

Old hardware is one thing that drags it out, and I said as much on that same planning call: “Dealers are typically very reactive with all of their IT assets. They don’t want to upgrade. They think they’re on the right side of things. They’re saving money, and really, they’re on the wrong side of things, because they have things that break unexpectedly.” In the same conversation I put it in shop terms: “You’ve got old laptops in the shop that they’re using to program cars, and you might not be on a lift for an hour, doing a download, when it should be on the lift for 10 minutes.”

Some of that time we take on purpose. We won’t take a store’s setup as-is and work around the mess. Every store goes onto one standard, and if a dealership won’t standardize, we won’t take them on.

Why be stubborn about it? One of our early dealer clients was running the techs’ electronic dispatch on a $50 home router that kept going down, and I talked them into a corporate-grade device at ten times the price, and it worked. I’ve lost deals since to cheaper bids. Cutting corners costs more later.

Is a DMS change landing in the same quarter? Plan it as its own project. Our DMS transition support page covers the planning and security around a migration.

Fast and right aren’t always the same schedule.

Before You Make the Call

Not sure what you’re paying for today? Start with our complimentary IT and cybersecurity assessment. We’ll review your current setup and security tools, stack your bills from every vendor against what one accountable team would cost, and put the findings in writing. You’ll have the full picture on paper before you decide anything.

Leaving a provider is a project. Run it like one.