Co-Working
If your IT provider refuses to release passwords or documentation, make a written request, preserve every response, and start recovering control of business-owned accounts. Secure email, domains, backups, and identity systems first. If the refusal threatens operations, data, or contract rights, involve legal counsel and an independent technology partner.
What should I do first when an IT provider will not release access?
“John brought the right knowledge to my issue and resolved it in about a reasonable amount of time. I walked away confident the problem was actually fixed.”
Treat this as a continuity and security problem, not just a disagreement with a vendor. If one outside company controls the credentials, recovery methods, or documentation for systems your team relies on, it can interrupt work, delay recovery, and create unnecessary risk.
Send a clear written request to the provider's authorized contact. List the accounts, records, administrative access, configuration files, vendor contacts, license details, and documentation you need. Ask for delivery through a secure method rather than requesting passwords through ordinary email.
Keep the request factual and specific. Record what you requested, when you requested it, who received it, and how the provider responded. That record may be useful if leadership, counsel, an insurer, a carrier, or a software vendor must get involved.
Within 24 hours, preserve every denied request, response, invoice, contract, and support record connected to the dispute.
Identify people in your organization who may already have account access. Finance may control billing portals, an owner may be listed as the domain registrant, and facilities staff may have access to internet-carrier, camera, or access-control portals.
In the Atlanta metro, these gaps often surface during an office move, tenant buildout, acquisition, or outage. The immediate objective is simple: make sure no provider remains the only party able to control technology your business depends on.
The takeaway: document the refusal and begin securing business-owned access right away.
Which accounts and records should my business control?
Your business should retain legal and practical control of its core technology accounts. A technology partner may need delegated administrative access to support the environment, but it should not be the only owner, recovery contact, or holder of critical credentials.
Start with the domain registrar, DNS, Microsoft 365 or other email tenant, cloud identity platform, backup service, security tools, internet-carrier portal, phone system, and payment accounts. These systems often control access to other services, which makes them the highest priority during a transition.
For every platform, identify the account owner, billing owner, technical administrator, recovery email, multi-factor authentication method, renewal date, contract term, license count, and vendor support contact. Multi-factor authentication should be connected to people your business authorizes, not solely to a provider's device or mailbox.
Control also extends to physical technology. Firewalls, switches, wireless equipment, cameras, door controllers, carrier handoffs, structured-cabling records, and telecom-room documentation can all affect whether a location remains operational after a provider relationship ends.
Ownership does not mean giving everyone unrestricted access. A responsible technology partner can use delegated permissions, approved credential storage, documented emergency access, and least-privilege controls while the client retains ultimate authority.
The takeaway: your company should be able to recover every business-critical account without depending on a former provider.
What should a complete IT handover include?
A password list is not enough. Credentials without context may leave a new team unable to restore services, renew subscriptions, trace a network problem, or understand which systems depend on one another.
Ask for current documentation in a readable format and request the date it was last updated. If records are incomplete, the provider should identify what is missing instead of presenting outdated documentation as complete.
- Administrative access and recovery procedures for domains, DNS, email, cloud services, business applications, backups, carriers, phone systems, and security tools.
- An asset inventory covering laptops, servers, network equipment, mobile devices, printers, cameras, access-control hardware, and software licenses.
- Network documentation showing internet circuits, firewall details, wireless networks, switching, IP addressing, remote access, and known dependencies.
- Vendor contacts, contract renewal dates, active projects, open support issues, escalation paths, and service commitments that are in effect.
- Security records covering endpoint protection, identity controls, backup and recovery procedures, incident contacts, access reviews, and known risks.
For organizations with more than one office, request site-specific documentation. A generic network diagram can conceal critical differences between locations, including internet circuits, equipment models, carrier contacts, wireless coverage, and local security systems.
Commercial property and facilities teams should also request records for riser spaces, telecom rooms, carrier access, low-voltage pathways, and base-building infrastructure. Those records matter when a tenant moves, a carrier changes service, or a contractor needs to work without disrupting other occupants.
The takeaway: ask for documentation that explains how your environment works, not just a spreadsheet of logins.
How can I regain control without causing an outage?
Do not reset every password at once. A rushed reset can disconnect a line-of-business application, break a backup job, interrupt a phone integration, or lock out a system that relies on a shared administrator or service account.
Begin with a transition assessment that confirms what can be verified from your systems, vendor portals, billing records, equipment, and authorized employees. It should distinguish between documented access, recoverable access, unknown access, and information that the former provider is withholding.
| Transition approach | What it does | Main risk |
|---|---|---|
| Wait for the former provider | May avoid immediate changes if cooperation resumes | Your operations remain dependent on a party withholding access |
| Reset accounts independently | Can restore control through vendors, registrars, and carriers | Undocumented dependencies can cause service interruptions |
| Run a managed transition assessment | Builds an inventory, preserves evidence, and sequences recovery work | Requires coordination across leadership, users, vendors, and facilities |
Prioritize identity and communications systems first. Secure the domain registrar, DNS, email tenant, cloud identity platform, multi-factor recovery methods, and executive accounts before moving to firewalls, backups, endpoints, applications, and physical-security systems.
Review shared administrator accounts, integrations, service accounts, automated billing, backup agents, and remote-access tools before changing credentials. The goal is not merely to lock out the former provider; it is to restore accountable control while keeping people able to work.
A qualified transition team should document each change, confirm access after the change, and identify any remaining recovery work. That approach gives leadership a usable record rather than a collection of emergency fixes.
The takeaway: recover control in a planned order so a credential change does not become a business interruption.
When should I involve legal counsel, vendors, or a new technology partner?
Involve legal counsel promptly if the provider is withholding assets your business owns, refusing clear contract obligations, threatening to delete or shut down services, retaining sensitive data, or demanding payment not supported by the agreement. Counsel can assess the contract, ownership evidence, notices, and escalation options.
Contact vendors directly when you can demonstrate that your organization owns the account or service. Contracts, invoices, payment records, domain-registration history, authorized-signer details, and corporate records may help support a recovery request.
Each vendor has its own authorization process. Be prepared to confirm your identity and business relationship before it changes an account owner, resets credentials, or removes a former administrator.
If customer data, protected information, payment data, or sensitive credentials may be exposed, handle the matter as a potential cybersecurity incident. Preserve evidence, limit unnecessary access changes, determine what information may be at risk, and document decisions as the situation develops.
A new technology partner should not promise instant recovery without discovery. The right first step is to identify what the business owns, what remains accessible, what is undocumented, what is at risk, and what must be stabilized before larger changes are made.
The takeaway: escalate early when withheld access creates legal exposure, security risk, or a credible threat to operations.
How can I prevent this problem with my next IT provider?
Put ownership and transition requirements in writing before the relationship begins. Your agreement should state that business accounts, data, domains, licenses, configurations, and documentation remain under your organization's control.
Require regular documentation reviews and make sure designated leaders can access the credential vault, account-recovery contacts, vendor records, and current network documentation. Test that access before an emergency or a provider change forces the issue.
Ask how the provider handles offboarding, account ownership, delegated administration, emergency access, documentation updates, and return of client records. A capable partner should be able to explain the process clearly without treating basic access as proprietary leverage.
Review your technology records during major business changes such as a move, acquisition, leadership change, carrier replacement, or new security deployment. Those moments often reveal ownership gaps before they become an outage.
The takeaway: the best transition plan is one that is documented, tested, and owned by your business before you need it.
For more on this, see Data Backup & Recovery Services in Atlanta, IT Support for Commercial Real Estate in Atlanta and Structured Cabling and Low Voltage Services in Atlanta.
Frequently Asked Questions
Can my IT provider legally keep my passwords?
Whether a provider can keep access depends on your contract, account ownership, applicable law, and the service involved. Preserve records, confirm ownership for each account, and seek legal advice when access is withheld. A provider's administrative role does not automatically make it the owner of your business accounts or data.
What if the IT provider set up the accounts under its own email address?
Gather invoices, contracts, payment records, domain details, and evidence that the account supports your business. Contact the software vendor, carrier, registrar, or platform through its authorized recovery process. Before changing anything, identify linked accounts and dependencies so recovering ownership does not interrupt email, applications, backups, or communications.
Should I change all passwords immediately after regaining access?
Change critical credentials promptly, but in a documented order. Start with domain, identity, email, multi-factor recovery, and executive accounts. Then review service accounts, integrations, backup tools, phones, network equipment, and security platforms so a reset does not unintentionally interrupt business services or prevent recovery later.
What documentation should I ask a new technology partner to create?
Ask for an asset inventory, network diagram, vendor and contract list, account-ownership record, license inventory, backup and recovery procedures, security-control summary, open-issue register, and site-specific infrastructure documentation. The records should identify gaps, show when they were updated, and remain accessible to authorized leaders at your business.
