Global admin transition from prior MSP

Overview

Taking Global Administrator or equivalent is adversarial diplomacy with the outgoing MSP—assume good faith but verify.

Preconditions

Written authorization from customer exec; legal non-disparagement clause does not block technical handover timeline.

Technical steps

• Create new break-glass + PIM-eligible admin in your IdP; do not reuse prior MSP named accounts as long-term solution.
• Inventory guest accounts and app registrations owned by old MSP identities—rotate secrets or re-register.
• Remove / disable former MSP accounts after parallel access overlap window ends—document exact timestamp.

Collaboration

Use shared transition channel with read receipts on critical/password messages; export Conditional Access and Intune policies JSON for diff.

Risks

Residual RMM agents or SIEM forwarders sending data to old vendor—audited uninstall list mandatory.

Evidence

Change log in PSA showing who granted admin and which IP for compliance.