How Can an Insurance Agency Change IT Providers Without Disrupting the Business?
An insurance agency can switch IT providers without significant downtime by following a structured transition plan that covers six critical areas: contract review, technology documentation, access control, cybersecurity continuity, data protection, and employee communication.
For an insurance agency with 25–50 employees, a well-managed transition will commonly require 30–60 days. More complex environments, including multiple offices, servers, remote employees, or undocumented systems, may require additional time.
The safest approach is to select the new managed service provider before terminating the current relationship, establish a written transition timeline, secure administrative access, verify backups, and confirm that monitoring and security protections remain active throughout the handoff.
The goal is not merely to avoid an obvious outage. A successful transition should protect client information, preserve access to Microsoft 365 and insurance applications, prevent security gaps, and give employees a clear way to request support from the first day of the new relationship.
The 7-Step IT Provider Transition Framework
- Identify why the agency is changing providers.
- Review contracts, obligations, and termination requirements.
- Select the new MSP and create a transition plan.
- Inventory systems, vendors, accounts, and administrative access.
- Verify backups, cybersecurity, and business continuity.
- Transfer support, monitoring, documentation, and vendor relationships.
- Validate the environment and close the former provider’s access.
Each step should have an assigned owner, target date, and completion criteria. Avoid relying on verbal promises or assuming that one provider has completed a task because the other provider requested it.
Step 1: Identify Why the Agency Is Changing IT Providers
Before choosing a replacement, document the problems the agency expects the new provider to solve. Without clear goals, the agency may select a provider that offers different technology but delivers the same disappointing experience.
Common reasons insurance agencies change MSPs include:
- Slow response times
- Recurring problems that never receive permanent solutions
- Difficulty reaching a live technician
- Unexpected project and support charges
- Weak cybersecurity protections
- Limited Microsoft 365 expertise
- Untested backups
- Poor communication
- Incomplete documentation
- No strategic technology planning
- Frequent employee complaints
- Insufficient support for growth or multiple offices
- Difficulty completing cyber insurance applications
Turn Complaints Into Measurable Requirements
Replace general statements such as “support is too slow” with specific expectations. For example:
| Current Complaint | Requirement for the New Provider |
|---|---|
| It takes too long to get help. | Employees must have access to a live support channel with documented response targets. |
| The same problems keep returning. | Recurring tickets must receive root-cause analysis and a documented corrective plan. |
| We receive unexpected invoices. | The agreement must clearly define included services, exclusions, projects, and after-hours charges. |
| We do not know whether backups work. | The provider must monitor backups and perform documented restoration tests. |
| Cyber insurance questions are difficult to answer. | The provider must maintain security documentation and help verify technical controls. |
| No one helps us plan. | Leadership must receive scheduled technology reviews, a roadmap, and budgeting guidance. |
This requirements list becomes the agency’s scorecard for evaluating proposals and measuring the new provider after onboarding.
Step 2: Review the Existing IT Contract Before Giving Notice
Review the current managed service agreement before notifying the provider that the agency plans to leave. The contract may contain notice periods, automatic renewal provisions, equipment obligations, software commitments, data-return terms, and transition fees.
Look for provisions addressing:
- Required termination notice
- Automatic renewal dates
- Early termination charges
- Transition assistance
- Documentation ownership
- Data export and return
- Administrative credential transfer
- Software license ownership
- Leased or provider-owned equipment
- Backup data retention after termination
- Domain and website ownership
- Phone-system ownership
- Security and monitoring tools
- Final billing
- Confidentiality requirements
Agency leadership should involve legal counsel when contractual obligations, ownership, or access rights are unclear.
Do Not Cancel Services Too Early
Terminating the current provider before the replacement is ready may create gaps in help desk coverage, endpoint protection, email filtering, backup monitoring, patch management, or administrative access.
It is often safer to allow a controlled overlap while the new provider documents systems, deploys tools, verifies protections, and confirms readiness. The overlap should be planned carefully so that both providers understand their responsibilities.
Identify Provider-Owned Technology
Some MSPs include hardware, security products, cloud services, or software licenses as part of the monthly agreement. Determine whether the agency owns or merely uses:
- Firewalls
- Wireless access points
- Network switches
- Backup appliances
- Servers
- Microsoft 365 licenses
- Email filtering services
- Endpoint security licenses
- Domain registrations
- VoIP equipment
- Remote monitoring tools
- Password-management platforms
The new provider may need to replace a product immediately when the old agreement ends. Identifying those dependencies early prevents last-minute security or service interruptions.
Step 3: Select the New MSP Before Starting the Transition
The new provider should be selected and contractually engaged before the transition begins. That allows the agency and new MSP to build the timeline together and identify risks before the former provider receives notice.
Evaluate the new MSP in five areas:
- Support: How employees request help, when technicians are available, and how unresolved issues are escalated.
- Cybersecurity: Which protections are included and who monitors security events.
- Continuity: How backups, disaster recovery, and service availability are managed.
- Insurance-industry support: How the MSP coordinates with agency-management systems, carrier portals, and cyber insurance requirements.
- Strategy: How the provider helps leadership budget, replace aging technology, and reduce long-term risk.
Review the services that should be included on the managed IT services page before comparing proposals.
Questions to Ask the New MSP
- Who will manage the transition?
- How many MSP transitions have you completed?
- What information do you need from the former provider?
- How do you handle an uncooperative outgoing provider?
- How will you prevent a gap in endpoint protection?
- How will you verify Microsoft 365 administrative access?
- How will you test backups before assuming responsibility?
- How will you identify undocumented systems and vendors?
- When will employees begin contacting your help desk?
- What work occurs during business hours?
- What work may require an evening or weekend maintenance window?
- How will you verify that onboarding is complete?
- What reports will agency leadership receive?
- Which transition activities are included in the monthly fee?
- Which activities will be billed as a separate project?
Step 4: Build a Complete Technology and Access Inventory
A provider transition becomes risky when important systems, accounts, or vendors are discovered only after something stops working. The agency and new MSP should create a comprehensive inventory before the handoff.
User and Device Inventory
Document:
- Employees, contractors, owners, and shared users
- Desktop computers and laptops
- Remote and home-office equipment
- Servers
- Mobile devices that access business data
- Printers, scanners, and multifunction devices
- Firewalls, switches, and wireless equipment
- Conference-room equipment
- VoIP phones and communication systems
Application Inventory
Include every business-critical application, such as:
- Microsoft 365
- Microsoft Teams
- SharePoint
- OneDrive
- Applied Epic
- AMS360
- HawkSoft
- EZLynx
- Vertafore products
- Carrier portals
- Accounting and payment systems
- Document-management platforms
- Client communication tools
- Electronic signature platforms
- VoIP systems
- Remote-access tools
Vendor Inventory
Record the vendor, primary contact, support number, account identifier, renewal date, and responsible agency employee for:
- Internet service
- Telephone service
- Copiers and printers
- Agency-management applications
- Microsoft licensing
- Website hosting
- Domain registration
- Cyber insurance
- Security services
- Backup platforms
- Cloud applications
- Hardware warranties
Administrative Access Inventory
The agency should confirm access to:
- Microsoft 365 global administration
- Domain registrar and DNS
- Firewall and network equipment
- Backup systems
- Endpoint security platform
- Email filtering
- Servers and virtualization platforms
- Website and hosting accounts
- VoIP administration
- Cloud applications
- Remote-access systems
- Hardware and software vendor portals
Administrative credentials should be transferred through a secure method. They should not be placed in an unencrypted email, spreadsheet, or shared document.
What Documentation Should the Former Provider Deliver?
The outgoing provider should supply the documentation and access required to operate the environment, subject to the agency’s agreement and ownership rights.
A transition request may include:
- Current user list
- Device and server inventory
- Network diagram
- IP addressing information
- Firewall configuration
- Wireless network information
- Microsoft 365 tenant details
- Administrative accounts
- Domain and DNS access
- Backup configuration and retention details
- Recovery procedures
- Software and license inventory
- Vendor contact information
- Open support tickets
- Known recurring problems
- Current projects
- Hardware warranties
- Internet and phone account information
- Security exceptions
- Upcoming renewals
- Employee onboarding and offboarding procedures
Do Not Assume the Documentation Is Complete
The new MSP should validate the information against the actual environment. Documentation may be outdated, incomplete, or based on systems that have changed since the records were created.
The transition process should include network discovery, account review, device verification, software inventory, and interviews with employees who understand important workflows.
Step 5: Verify Backups Before Making Major Changes
Backup verification is one of the most important parts of an IT transition. The new MSP should confirm what is protected, where backups are stored, who controls them, and whether data can be restored.
Review backups for:
- Servers
- Shared files
- Microsoft 365 email
- SharePoint
- OneDrive
- Teams data where applicable
- Agency-management information
- Accounting data
- Critical workstation files
- Firewall and network configurations
Questions to Answer Before the Handoff
- Which systems are backed up?
- How frequently are backups created?
- Where are backup copies stored?
- Who owns the backup account and data?
- Will backups remain available after termination?
- Are backup copies protected from ransomware?
- When was the last successful restoration test?
- How quickly can critical systems be recovered?
- How much recent data could be lost?
- Does the new MSP need to create an additional backup before making changes?
A successful backup notification does not prove that every important system can be restored. The agency should request documented recovery testing before the former provider removes access or equipment.
Learn more about recovery planning through business continuity services.
Step 6: Maintain Cybersecurity Coverage During the Transition
A provider transition can create a temporary security gap if the old MSP removes its tools before the new MSP deploys replacements. Security responsibilities should be mapped product by product and system by system.
Controls that require continuous coverage include:
- Endpoint detection and response
- Managed antivirus
- Email filtering
- Multi-factor authentication
- Firewall management
- Vulnerability monitoring
- Patch management
- Backup monitoring
- Security awareness training
- Security event monitoring
- Remote-access protection
Create a Security Tool Replacement Schedule
| Security Control | Outgoing Tool Removal | New Tool Deployment | Verification |
|---|---|---|---|
| Endpoint protection | Remove only after replacement is ready. | Deploy to every covered device. | Confirm active coverage and alerting. |
| Email security | Preserve filtering until mail flow is redirected. | Configure the replacement before changing mail routing. | Test inbound and outbound delivery. |
| Backup monitoring | Retain access until data is verified or migrated. | Deploy replacement protection where required. | Perform a restoration test. |
| Firewall management | Do not remove access before configuration is documented. | Transfer administration or replace the device. | Test internet, remote access, and security rules. |
| Patch management | Remove the former agent after the new system is staged. | Enroll every supported computer. | Confirm reporting and update status. |
The new provider should maintain a list of devices that have not successfully received the replacement tools. Remote, traveling, and rarely used computers are often the easiest to miss.
Review available protections through cybersecurity services.
Protect Administrative Accounts During the Handoff
Transitions require multiple people to work with privileged accounts. That makes access control particularly important.
The agency and new MSP should:
- Create named administrative accounts instead of sharing one login.
- Enable multi-factor authentication.
- Use separate accounts for administrative and everyday work.
- Record which provider has access to each platform.
- Limit privileges to the work being performed.
- Monitor significant configuration changes.
- Remove former provider access after validation.
- Change shared passwords that cannot be attributed to one person.
- Review forwarding rules and delegated mailbox access.
- Confirm emergency access procedures.
Do not disable the old provider’s access prematurely if it is still responsible for an active service. Instead, document when each account will be transferred or removed.
Step 7: Transfer Employee Support Without Confusion
Employees should know exactly when the new help desk becomes responsible and how to contact it. A transition can appear unsuccessful even when the technology works if employees continue sending requests to the wrong address or phone number.
Employee Communication Should Explain
- Why the agency is changing IT providers
- The date and time the new provider becomes responsible
- The new support phone number
- The new support email address or portal
- How urgent issues should be reported
- What software the new provider may install
- Whether computers need to remain powered on
- Whether employees should expect authentication prompts
- How onsite and remote employees will be supported
- Whom to contact with transition concerns
Prepare for an Increase in Support Requests
Employees often report long-standing problems when a new MSP begins. This temporary rise in ticket volume is normal and can help identify recurring issues that the former provider did not resolve.
The new MSP should separate requests into three categories:
- Immediate business interruptions: Problems that prevent employees from working or serving clients.
- Security and reliability risks: Issues that may not be visible to employees but require timely correction.
- Long-term improvements: Enhancements that should be planned and budgeted rather than rushed.
Coordinate Insurance Applications and Third-Party Vendors
Insurance agencies rely on systems that may be supported by several different vendors. The new MSP should establish communication with those providers and understand where its responsibility begins and ends.
Vendor coordination may involve:
- Applied Epic
- AMS360
- HawkSoft
- EZLynx
- Vertafore products
- Carrier portals
- Internet providers
- VoIP providers
- Copier vendors
- Accounting platforms
- Website and domain providers
- Cyber insurance brokers
The new MSP does not replace the application vendor, but it should be able to determine whether an issue originates with the user’s computer, local network, internet connection, Microsoft 365 identity, browser, security configuration, or third-party platform.
Confirm Critical Vendor Access
Before the transition is complete, verify that the agency can open support cases, manage authorized contacts, access billing records, and approve changes with every critical vendor.
Remove former IT personnel from vendor accounts when their access is no longer required.
A Sample 45-Day MSP Transition Timeline
| Timing | Primary Activities |
|---|---|
| Days 1–5 | Finalize the new MSP agreement, review the former contract, assign transition leaders, and document agency goals. |
| Days 6–10 | Notify the former provider, issue the documentation request, establish communication rules, and schedule technical discovery. |
| Days 11–20 | Inventory users, devices, accounts, vendors, applications, network equipment, and administrative access. |
| Days 21–25 | Verify backups, review security controls, document risks, and plan tool replacement. |
| Days 26–35 | Deploy monitoring and security tools, test help desk processes, update documentation, and coordinate vendors. |
| Days 36–40 | Communicate support procedures to employees, resolve critical findings, and validate remote and onsite coverage. |
| Days 41–45 | Complete final access review, remove former provider accounts, verify backups and security coverage, and deliver the transition report. |
The timeline should be adjusted for the agency’s contract, number of offices, technical complexity, available documentation, and cooperation from the outgoing provider.
What Work May Require a Maintenance Window?
Much of the onboarding process can occur without interrupting employees. However, some changes may require an evening, weekend, or scheduled maintenance period.
Examples include:
- Replacing a firewall
- Changing internet equipment
- Updating network configurations
- Migrating email filtering
- Replacing a backup appliance
- Changing remote-access systems
- Upgrading a server
- Migrating files or applications
- Replacing unsupported network equipment
- Correcting urgent security risks
For every maintenance event, the new MSP should document:
- The change being made
- The expected impact
- The start and end time
- The person approving the work
- The testing procedure
- The rollback plan
- The employee communication plan
How to Handle an Uncooperative Former IT Provider
Most professional providers cooperate with a reasonable transition request. Problems can still occur when documentation is incomplete, ownership is disputed, invoices remain unpaid, or communication becomes emotional.
The agency should:
- Keep requests professional and specific.
- Use one designated agency contact.
- Reference contractual obligations rather than making accusations.
- Request information in writing.
- Maintain a list of completed and missing items.
- Give reasonable deadlines.
- Include agency leadership when delays create business risk.
- Consult legal counsel when ownership or access is disputed.
- Avoid asking the new MSP to access systems without proper authorization.
The Agency Should Own Critical Accounts
Whenever practical, domains, Microsoft 365 tenants, cloud subscriptions, vendor accounts, and essential administrative relationships should be registered to the agency rather than exclusively to an individual provider employee.
This does not mean every agency employee should have unrestricted administrative access. It means the agency should retain ownership and have a documented process for granting authorized access.
Common MSP Transition Mistakes
| Mistake | Potential Result |
|---|---|
| Terminating the old provider before selecting the new one | The agency may lose support, monitoring, or security coverage. |
| Failing to review the existing contract | Unexpected fees, renewal obligations, or equipment disputes may arise. |
| Assuming documentation is complete | Unknown systems and accounts may fail after the handoff. |
| Removing old security tools too early | Devices or email may operate temporarily without protection. |
| Not testing backups | The agency may discover recovery problems during an actual emergency. |
| Sharing credentials by email | Privileged access may be exposed or remain available to unauthorized people. |
| Forgetting remote employees | Home and traveling computers may remain unmanaged. |
| Ignoring employee communication | Employees may continue contacting the former help desk or delay reporting problems. |
| Changing too many systems at once | Troubleshooting becomes more difficult and business disruption increases. |
| Leaving former provider access active | Unnecessary administrative access remains after the relationship ends. |
How to Verify That the Transition Is Complete
The new MSP should provide a written onboarding or transition report. Completion should mean more than installing a remote support agent.
Verify the following:
- Every current employee has a documented account.
- Every supported device appears in the management platform.
- Endpoint security is active on every required computer.
- Microsoft 365 administrative access is verified.
- Multi-factor authentication coverage is documented.
- Backups are monitored and recovery has been tested.
- Firewalls and network devices are documented.
- Vendor accounts and contacts are current.
- Remote employees can receive support.
- Open issues have assigned owners.
- Former provider accounts have been removed.
- Shared administrative passwords have been changed.
- Employee support instructions have been distributed.
- Critical risks have remediation plans.
- Agency leadership has received a technology roadmap.
Conduct a 30-Day Post-Transition Review
Approximately 30 days after the new help desk takes responsibility, leadership should review:
- Ticket volume
- Recurring employee problems
- Response and resolution performance
- Employee feedback
- Security findings
- Backup and recovery status
- Undocumented applications or vendors
- Aging hardware
- Upcoming projects
- Progress against the original transition goals
This meeting helps distinguish onboarding work from longer-term improvements and confirms whether the new relationship is producing the expected results.
A Practical Insurance Agency Transition Scenario
Consider a 35-person independent insurance agency with one main office, several remote producers, Microsoft 365, an agency-management platform, cloud-based phones, and a local server.
The agency plans to leave its current MSP because employees wait too long for support, security responsibilities are unclear, and leadership receives no technology planning.
During discovery, the new provider identifies:
- Three remote laptops missing from the current inventory
- Several former employee Microsoft 365 accounts
- A firewall managed through the outgoing provider’s account
- Server backups that have not been restoration-tested recently
- No separate recovery plan for Microsoft 365 data
- An undocumented shared administrative account
- Two aging network switches
- Employees using different methods to request help
The agency and new MSP create a 45-day transition plan. They verify backups before making changes, move the firewall into an agency-controlled account, deploy endpoint protection to every computer, disable unused accounts, document vendors, establish one help desk process, and schedule the network replacement as a separate project.
The transition is successful not because no changes were required, but because the changes were identified, prioritized, communicated, and completed without leaving critical systems unprotected.
Frequently Asked Questions
How long does it take to switch managed IT providers?
A straightforward transition for a 25–50 employee agency may take approximately 30–60 days. Multiple offices, servers, undocumented systems, equipment replacement, or an uncooperative provider can extend the timeline.
Will employees experience downtime?
Many onboarding activities can occur without significant disruption. Firewall replacements, network changes, migrations, and other infrastructure work may require planned maintenance windows. The new MSP should communicate expected impact and maintain a rollback plan.
Should we tell the current provider before choosing a new MSP?
It is generally safer to review the contract and select the new provider first. That gives the agency a transition partner and reduces the risk of losing support or security coverage before a replacement is ready.
Can the current MSP refuse to provide passwords?
Access and documentation obligations depend on the contract, system ownership, account registration, and applicable law. The agency should review its agreement and seek legal guidance when access is disputed.
Should both providers work together?
A coordinated handoff is usually the safest approach. The outgoing provider can supply documentation and knowledge, while the incoming provider validates the environment and assumes responsibility according to an agreed schedule.
How much overlap should there be between providers?
The appropriate overlap depends on contract terms and technical complexity. The overlap should last long enough to verify access, deploy replacement tools, confirm backups, and transfer support without paying both providers indefinitely.
What happens to our security software when we leave?
Security software supplied by the former MSP may be removed when the agreement ends. The new provider should identify every affected product and deploy replacements before the existing protection is discontinued.
What happens to our backups?
Backup ownership and retention depend on the agreement and platform. Confirm whether the agency can access or export its data, how long backups remain available, and whether a replacement backup must be created before termination.
Should administrative passwords be changed?
Shared or provider-known credentials should be changed after the new MSP has verified access and assumed responsibility. Named accounts should be reviewed, and former provider accounts should be removed when no longer required.
Can we change MSPs during a cyber insurance renewal?
It is possible, but the agency should coordinate carefully so that application answers remain accurate and required controls remain active. Maintain documentation showing which provider was responsible for each control during the transition.
Should we switch every technology product at the same time?
Not necessarily. Replacing too many systems at once can increase risk. The new MSP should separate urgent security changes from improvements that can be planned after the environment is stable.
What should the new MSP deliver after onboarding?
The provider should deliver updated documentation, an inventory, a list of risks, confirmation of security and backup coverage, open issue assignments, and a prioritized technology roadmap.
Switch IT Providers With a Plan, Not a Leap of Faith
An insurance agency does not need to remain with an unresponsive or ineffective IT provider because it fears disruption. The safest transition comes from planning the change before giving notice and assigning clear responsibility for every system, account, security control, backup, and vendor relationship.
Use the seven-step framework:
- Document the reasons for changing providers.
- Review the existing contract and ownership obligations.
- Select the new MSP and create the transition timeline.
- Inventory technology, applications, vendors, and administrative access.
- Verify backups and maintain cybersecurity coverage.
- Transfer support, documentation, and vendor relationships.
- Validate the environment and remove former provider access.
A disciplined transition should leave the agency with stronger documentation, clearer ownership, consistent security, dependable employee support, and a practical roadmap for future improvements.
911 IT provides managed IT services, cybersecurity services, business continuity planning, and cloud services for organizations evaluating or changing technology providers.
Concerned that changing IT providers will interrupt your agency? Schedule a discovery call with 911 IT to discuss your current environment, contract timeline, security risks, support problems, and transition priorities.
