How are client passwords and admin access handed over when an MSP is sold?

A managed service provider holds the keys to many other businesses. That makes the handover of passwords and admin access one of the most careful steps in the sale. The big-picture view is in selling a managed IT services business in Canada. This page covers only the mechanics of how access changes hands.

Start with a full inventory

Before anything moves, the seller lists every credential and system the company uses: the password vault, the remote-management and monitoring tools, the ticketing system, cloud admin consoles and accounts on each client’s own systems. For each one, note who holds it, whose name it is in and who else can reach it. A list like this also shows the buyer what it is actually getting.

Find the accounts in the owner’s name

Some accounts, such as vendor portals, domain registrations or partner programs, may sit in the owner’s personal name or on the owner’s personal email. Those need a plan to move them to the company or to the buyer. Ask which vendors require their own approval for a change of ownership. The vendor, not the seller, may set that process.

Change access in a sensible order

Many handovers first add the buyer’s people as users, then move the vault and management tools, then rotate the credentials, and only then remove the seller’s own access. Keep a written record of each step and who approved it. Tell clients in a planned way, because ask your lawyer whether client agreements or privacy rules affect who may hold their data.

Questions to settle with your lawyer

• What do client agreements say about moving access to a new owner?
• What privacy obligations apply to the information the MSP can see? Your lawyer can tell you.
• What happens if a credential is lost or misused during the transition?