"Our IT guy left and took the passwords": an IT handover checklist

It usually starts with a small problem. A new staff member needs an email account, or the website certificate expires, or the firewall needs a change for a new supplier. Someone says, “Just ask Johan.” And then everyone remembers that Johan left three weeks ago, his phone goes to voicemail, and nobody else knows the admin password.

This is one of the most common situations we walk into, and it is rarely anyone’s fault. A capable person set things up over several years, kept the details in their head, and the business never had a reason to ask for a copy. Until it did.

The good news is that it is almost always recoverable, if you work through it calmly and in order.

Why single-person dependency is a real risk

When one person holds all the keys, your business is exposed in a few specific ways:

• You cannot make changes. Adding users, changing firewall rules or renewing services all stall.
• You cannot see what is broken. If backups have been failing quietly, the alerts may be going to a mailbox nobody reads.
• You may not be able to prove ownership. Domains and cloud accounts are sometimes registered in a personal name or on a personal email address.
• Access may still exist for someone who has left. Even with the best intentions, an active admin account belonging to a former contractor is a security gap.

This is a reason to prioritise, not panic.

What to recover first

Work through these roughly in order. The early items control access to everything else.

1. Domain registrar and DNS

Your domain name is the root of your email, website and much of your Microsoft 365 setup. Find out where it is registered, whose name and email address the registrar account is in, and whether you can log in. If the account is tied to a former employee’s personal address, start the registrar’s ownership verification process now. It can take days, and you want it done before anything needs changing.

2. Microsoft 365 global administrator

Check who holds global admin rights in Microsoft 365. If no one currently employed can sign in as a global admin, Microsoft has a documented process for proving tenant ownership, usually through a DNS record on your domain, which is why the registrar comes first. Once you are in, create named admin accounts for the right people, remove or reset any admin accounts belonging to people who have left, and make sure every admin account uses MFA.

3. Firewall

Your firewall controls who can reach your network from outside, including VPN access. Recover the admin login, export a copy of the configuration, and review the VPN user list for anyone who should no longer have access.

4. Backup console

You need to know whether your backups are running, what they cover and where failure alerts go. If you cannot log in to the backup console, you cannot answer any of those questions. Our backup self-check is a good next step once you have access.

5. Password manager

If the previous person used a business password manager, find out who else has access to the vault. If they used a personal one, assume you will need to reset each credential as you rediscover it, and start a proper shared business vault today.

6. Line-of-business application admin

Your accounting package, practice management system or CAD licensing portal will each have an administrator account, often managed directly with the vendor and easily forgotten.

7. Vendor and supplier accounts

Fibre and LTE providers, licensing portals, hosting, the VoIP provider and support contracts. Update contact details so renewal notices and security alerts reach a role mailbox someone reads.

A useful rule: if a service would stop working when a credit card or contact person changes, it belongs on this list.

Set up break-glass accounts

A break-glass account is an emergency administrator account that is not used day to day. Its job is to get you back in if normal admin access fails, whether because someone left, an MFA device was lost or a sign-in policy locked everyone out.

For Microsoft 365, a sensible approach is:

• Two cloud-only emergency admin accounts, not tied to any one person.
• Strong, long passwords stored securely, with access known to at least two trusted people (for example, a director and your IT provider).
• Excluded carefully from policies that could lock them out, but protected and monitored in other ways, so any sign-in raises an alert.
• Tested periodically to confirm they still work.

The same principle applies elsewhere: the firewall, the backup console and the domain registrar should each have a documented way back in that does not rely on a single human.

A documentation standard that actually gets used

Documentation needs to be complete, current and somewhere the business controls, not elaborate. For a 30 to 100 person organisation, we aim for:

• An asset list: servers, firewalls, switches, laptops and key software, with locations and warranty dates.
• A credentials vault: a business password manager with role-based access, never a spreadsheet.
• A network overview: internet links, firewall, VPNs, Wi-Fi, IP ranges, and how the office connects to any hosted servers.
• A vendor list: every supplier, account number, renewal date and support contact.
• Runbooks for routine tasks: onboarding and offboarding staff, restoring a file, what to do when the internet goes down.
• A change log: what changed, when, and who did it.

The test is simple: could a competent outsider pick this up and run your IT next week without phoning anyone? If the answer is no, there is a gap.

How to avoid this next time

Most of the prevention is habit rather than technology:

• Admin accounts belong to roles, not people. Named individual admin accounts are fine for accountability, but there must always be more than one person with access.
• Use business addresses for every registration. Domains, licences and vendor portals should use a role mailbox such as it@ or admin@, not a personal Gmail.
• Offboarding includes IT. When anyone with admin rights leaves, their access is reviewed the same day, and credentials they knew are rotated.
• Review once a quarter. A short check of who has admin access, where alerts go and whether documentation is current.
• Ask for a copy. If you use an outside provider, your documentation and passwords should be handed to you on request, without negotiation.

Our promise is documented, no-hostage IT: your documentation and passwords belong to you, and your business never depends on one person’s memory, including ours.

How a managed service provider takes over safely

When we take over an environment, especially one where the previous person has already left, we follow a fixed sequence rather than diving in and changing things.

1. Discovery. We map what exists: accounts, devices, services, vendors and backups. We do not change anything we do not yet understand.
2. Stabilise. We secure the essentials first: recover admin access, enforce MFA on admin accounts, remove access for people who have left, and confirm backups are running and alerts reach someone.
3. Document. We build the asset list, vault, network overview and vendor list described above, and hand you a copy.
4. Improve. With a clear picture, we agree a structured roadmap for the things that need fixing, in priority order.
5. Operate. Day-to-day support, monitoring and maintenance on our 24/7 retainer.

We reduce takeover risk by first securing the essentials, then improving in a structured roadmap. A 40-person architectural practice in Menlyn does not need its network rebuilt in week one. It needs to know who can get into its Microsoft 365 tenant, that its project files are backed up, and that no former contractor still has VPN access.

Where to start

If you are not sure who holds your admin passwords, that is a useful realisation, not a crisis. Start with the domain and Microsoft 365, then work down the list.

If you would like a second pair of eyes, our free Automation & Risk Check is a 30-minute review of the basics (backups, security and documentation) alongside where automation could save your team time. You get a one-page report you can act on yourself or with us. No obligation.