Who owns the passwords and domain when you change IT companies?
Your business does, or it should. The domain, the Microsoft 365 or Google tenant, the licenses, the firewall and switch configurations, the backups, the phone numbers and the documentation all belong to the company that pays for them. An IT provider is a caretaker with its own administrator accounts, nothing more. If any of that sits in a Dallas provider's own name, fix it before you need to leave.
Answered by Anthony Omini, Cross River Tech, Dallas
Key takeaways
- Domain, tenant, licenses, configurations, backups, phone numbers and documentation belong to your business, not to whoever administers them.
- The two items that most often sit in a provider's name are the domain registrar account and the Microsoft 365 tenant.
- You can verify most of it yourself in about fifteen minutes without involving your provider.
- Ask for documentation as a normal part of service, not as a parting request; the answer tells you what kind of relationship you have.
- Put ownership and exit terms in writing before you sign, because after a dispute it is a negotiation instead of a clause.
Who owns the passwords and domain when you change IT companies?
The business owns them. Whoever pays the bills owns the domain, the accounts, the licenses, the equipment and the documentation describing how it all fits together. An IT provider administers those things on your behalf and holds its own named accounts to do the work. That is the whole relationship, and any arrangement that quietly moves ownership somewhere else should be corrected regardless of how well the current relationship is going.
The problem is that ownership is rarely decided deliberately. Someone set the business up years ago, registered the domain on whatever account was handy, created the Microsoft 365 tenant with their own email address, bought a firewall and configured it, and never wrote any of it down. Nobody was acting in bad faith. But when that person retires, sells the business or stops answering, you discover that the company's email lives inside an account nobody in your building controls.
This is fixable while everyone is on speaking terms and painful afterwards, which is the whole argument for checking now. Everything below is a list you can work through in an afternoon, and the questions are the same whether your provider is a large managed service company, a small owner-led company like mine, or the founder's nephew who set it up as a favor.
Does my IT company own my Microsoft 365 tenant?
Usually not, but it happens often enough that you should check rather than assume. A tenant is the container holding your email, files, accounts and licensing. Whoever controls it controls whether your company can send email tomorrow.
There are three arrangements you will find in practice. The healthy one: the tenant is registered to your business, at least one global administrator is a person who works for you, and your provider holds a separate named administrator account. The common but fixable one: the tenant is registered to your business, but every global administrator account belongs to the provider, so you have ownership on paper and no way to exercise it. The bad one: the tenant was created under the provider's own account or partner arrangement, and your licenses are billed through them in a way that makes leaving mean rebuilding.
To find out, sign in to the Microsoft 365 admin center or the Google Workspace admin console with the most senior account you have, and look at the list of accounts with global or super administrator rights. If nobody in your business appears on that list, that is the finding. Also look for a delegated administration or partner relationship, which is a separate arrangement letting an outside company administer your tenant without holding an account in it. It can be legitimate and it should still be something you know about and can end.
The fix in the first two cases is straightforward: create a global administrator account belonging to someone inside your business, plus one emergency account whose recovery details are stored offline and whose multi-factor authentication does not depend on one particular employee's phone. In the third case, a tenant-to-tenant move or a billing transfer is required, which is real work but far cheaper done calmly than during a dispute. Being locked out entirely is a different situation with its own recovery path, described in locked out of your Microsoft 365 admin account.
What must your business own, item by item?
| Item | What ownership means | How to verify it |
|---|---|---|
| Domain name | Registered to your business at a registrar account you can sign in to | Sign in to the registrar; check the registrant organization and the account email |
| Microsoft 365 or Google tenant | Registered to your business, with an internal global administrator | Open the admin center and list who holds administrator rights |
| Licenses and subscriptions | Billed to you, or transferable to your own billing if you leave | Check the billing section, or ask who the reseller of record is |
| Firewall and switch configuration | You hold the admin credentials and a saved copy of the configuration file | Ask for the configuration export and store it with your records |
| Backups | The backup account is in your name and you can see where data is stored | Log in to the backup console; confirm the account holder and the retention setting |
| Documentation | An asset inventory, network diagram, account list and vendor list you hold a copy of | Request the current copy; a good provider sends it without hesitation |
| Phone numbers | The carrier account is in your business name so numbers can be ported | Check the carrier portal for the account holder and any port-out restriction |
| Password manager | The subscription belongs to your business with the provider as a removable member | Check who the account owner is in the manager's admin settings |
| Equipment | Purchased by you, invoiced to you, with serial numbers recorded | Match invoices against an asset list; note anything rented or provided |
| Website and DNS | Hosting account in your name, DNS records documented | Confirm who can edit DNS and where the site files live |
The two rows that cause the most damage are the first two. A domain in someone else's registrar account can stop your email, your website and your logins in a single afternoon, and recovering it without cooperation means going through the registrar's own dispute process. Check that one first even if you read nothing else here.
How do I check all of this today?
Set aside part of an afternoon and work in this order. You do not need your provider's help for most of it, and doing it quietly is perfectly reasonable.
- Find the domain. Look up your domain at any registrar lookup, then find the account it lives in and sign in. If you cannot, ask your provider which registrar holds it and for the account to be transferred into your name.
- Open your tenant admin center and list every account with administrator rights, plus any partner or delegated relationship.
- Check billing. Whose card or invoice pays for your licenses, and can that be moved to yours?
- Log in to the backup console. If nobody in your business has ever logged in, that is the finding, and it is worth fixing before you test anything else.
- Ask for the firewall configuration export and the admin credentials. Store them in your password manager and in your offline break-glass record.
- Call your phone provider and confirm the account holder name and the authorized contacts.
- Request the documentation set in writing, described in the next section.
- Write down what you found, including the gaps. That document becomes the start of your own records.
Nothing here is confrontational. A provider doing the job properly will help you with every line and will already have most of it prepared, because it is the same information they rely on. Hesitation on any item is worth noticing, and it is one of the checks in how to check that an IT company is legitimate.
How do I get my IT documentation back?
Ask for it in writing, be specific about what you want, and give a reasonable date. Vagueness is what lets a reluctant provider send three screenshots and call it a handover.
A complete request covers: an asset inventory listing every computer, server and network device with model, serial number, age and warranty status; a network diagram or at least a written description of how the equipment connects; the list of user accounts, licenses and what each person has; administrator credentials for equipment and services, delivered into your password manager rather than by email; firewall and switch configuration exports; backup configuration, including what is protected, where it is stored, how long it is kept and how to restore it; the internet, phone and line-of-business vendor list with account numbers and support contacts; and a note of anything unusual about the environment that a new provider would need to know.
Ask for it as a normal part of service rather than as a parting shot. The best time is during a quiet quarter, framed as updating your own records for insurance and continuity purposes, which is entirely true. How the request is received tells you a great deal. A provider who sends it the same week is one you can rely on. A provider who stalls, charges an unexpected fee or asks why you want it has just answered a question you did not know you were asking, which is on the list in signs you need to change your managed service provider.
If nothing arrives, you can rebuild most of it independently. An inventory can be produced by walking the office and reading serial numbers. Accounts and licenses are visible in your tenant once you have administrator access. Firewall settings can be exported by anyone with the login, or reconstructed onto new equipment during a scheduled window. It costs hours you should not have had to spend, but no provider can hold your business hostage if you control the domain and the tenant.
What about equipment, licenses and phone numbers?
Three areas where ownership is less obvious than it looks, and where reading the invoice matters more than remembering the conversation.
Equipment. If you were invoiced for the firewall, the switch and the access points, they are yours, and you should hold the serial numbers and the admin credentials. Some providers instead include equipment inside the monthly fee, which is legitimate and means the hardware goes back when you leave. Both models are fine; what is not fine is not knowing which one you are in. Ask the question and write the answer into your records, and check whether any device carries a subscription for firmware, filtering or support that would need renewing in your own name.
Licenses. Microsoft and Google subscriptions bought through a reseller can usually be transferred to your own billing or to another reseller, though the process takes a few days and has to be requested. Software with a perpetual license bought for your business belongs to you, but only if the purchase record exists, which is why keeping copies of purchase confirmations matters. Anything bought under a provider's own volume arrangement deserves a direct question about transferability before you commit to it.
Phone numbers. Numbers are portable, but only by the entity that holds the carrier account. If the account is in the provider's name, they are the customer and you are not, and a port request will be rejected without their cooperation. Confirm the account holder is your business, that you are listed as an authorized contact, and that you can retrieve the account number and any PIN needed to port. This is the single most disruptive item to discover late, because a phone number cannot simply be recreated.
What should you put in writing before you sign?
Ownership clauses are short, uncontroversial and almost never in a small-business IT agreement unless someone asks. These are the ones worth requesting, and any provider who objects to them has told you something valuable at no cost.
- All accounts, tenants, domains, licenses and equipment purchased for the client are the property of the client, regardless of who administers them.
- Documentation is provided to the client and kept current, with a copy available on request at no additional charge.
- Credentials are stored in a password manager owned by the client, with the provider as a member.
- On termination, the provider hands over documentation and credentials and cooperates with a successor for a defined period, billed at normal rates if the work is substantial.
- Notice period and what happens during it, including whether support continues while the handover runs.
- No exit fee for the return of your own data or documentation.
Month-to-month billing only means something if leaving is practical, which is why I bill month-to-month and write these terms into what I provide rather than treating them as concessions. The broader question of what a service agreement should contain is covered in what a managed IT services agreement usually includes, and the mechanics of actually moving are in how to switch IT companies without downtime.
What does good ownership practice look like day to day?
It looks like being able to answer any question about your own systems within a few minutes, without calling anyone. That is the practical test, and it is what I aim to leave every client holding.
From the first month I keep a written record of your environment and give you a copy: devices with serial numbers and warranty dates, accounts and licenses, the network diagram, firewall and Wi-Fi configuration, internet and phone account details, vendor contacts, and where backups go with the steps to restore them. Passwords live in a manager your business owns. Your tenant and your domain stay in your name, with a break-glass administrator account you control that I do not. The access my team and I hold is named, logged and removable in one action, which is set out in what access an IT company needs to your systems.
That discipline costs me nothing except the comfort of being hard to replace, and I would rather keep clients because the work is good. If you want help running the ownership checklist on your own Dallas business, whether or not you are thinking about changing providers, get in touch or call (214) 612-7080. It is also the first thing I do when a business moves to managed IT support with me, because you cannot look after an environment nobody has ever written down.
Questions people ask
Can my IT company hold my domain hostage?
Only if the domain sits in a registrar account you cannot access. Registrars have dispute and ownership-verification processes, so it is recoverable, but it takes time and paperwork you would rather not spend during a bad month. Move the domain into an account in your business name while relations are good, keep the login in your password manager, and note the renewal date so it never lapses.
Should the domain be registered to me or to my IT provider?
To your business, with the registrant organization showing your company name and the account email going to an address you control rather than to the provider. A provider can be given access to manage DNS records, which is normal. Ownership of the account and the ability to unlock and transfer the domain should never leave the business that depends on it.
What if my old IT company will not give me the passwords?
You can recover most of it independently if you control the domain and the tenant, because those two let you reset almost everything else from the top down. Network equipment can be factory reset and reconfigured during a scheduled window. It costs hours rather than being impossible. Start by proving domain ownership, then work outwards, documenting as you go.
Do I own the firewall my IT company installed?
If you were invoiced for it, yes, and you should have the serial number, the admin credentials and a saved copy of the configuration. If it was included in a monthly fee, it may belong to the provider and go back when you leave. Both arrangements are legitimate. What matters is knowing which one applies before you plan a change, and having any subscription on it in your own name.
How often should I ask for updated documentation?
Once a year is a sensible rhythm, plus any time something significant changes such as a move, a server replacement or a new line-of-business system. Treat it as part of an annual review alongside license counts, device ages, backup restore tests and renewal dates. Keeping a current copy outside your provider's systems is what makes any future change routine rather than fraught.
Is any of this different for a one-person IT provider?
The requirements are identical whatever the size of the provider, and they matter more with a small company, because you will lean on the written records rather than on a large back office. Ask a small owner-led company like mine for exactly the same documentation, ownership terms and access practices you would ask of a large firm. If the answers are good, the small provider is safer than a big one with poor records, because you can pick up your environment and move at any time.
