The Real Reason MSPs Inherit Chaos — Poor Handover, Vague SLAs and Siloed Data

Incoming MSPs inherit chaos because clients, previous suppliers and contracts rarely provide a clean handover; the mess is usually contractual and organisational rather than purely technical. Fix the contract, inventory the estate and assert admin control — for example a misconfigured Microsoft 365 tenant often hides orphaned admin accounts.

Reactive Onboarding — Accepting Unknown Estates

Most incoming MSPs jump straight into firefighting: restore backups, reconfigure VPNs, reset locked accounts. That feels productive, but it treats symptoms, not the cause. The real trigger for inherited chaos is often a weak or missing exit process in the earlier supplier contract, overlain with incomplete documentation and retained access. When previous suppliers keep admin access, or when in-house staff don’t have a current inventory, the new provider spends the first few weeks mapping what exists instead of delivering value.

Consequences you commonly see:

• Unclear ownership of accounts and licences — who pays for Microsoft 365 seats or third-party SaaS?
• Orphaned admin users and stale credentials that pose security and compliance risk
• Hidden third-party integrations or firewall rules that break during change
• Billing surprises and duplicated licences that erode margins

These are organisational failures more than purely technical ones: missing sign-off on handover, no documented custodian for the estate, and SLA language that doesn’t force an exit audit. Accepting an unknown estate turns the onboarding phase into a cost centre and a reputational risk rather than a chance to stabilise the environment.

Concrete examples:

• A finance team’s Microsoft 365 tenant still had two global admins tied to the outgoing MSP; the incoming MSP had to prove control and reassign roles before proceeding.
• A clinic’s VPN credentials were embedded in legacy devices with no documented owner, which meant clinics faced hours of downtime while credentials were rotated.

Proactive Transition — Contracts, Checks and Clean Handover

The right approach treats the handover as a project, not a by-product. Start by fixing what caused the chaos: the contract and the lack of a verified inventory. Require a short, funded exit phase in the commercial terms that spells out deliverables: an asset list, admin account transfer, licence reconciliation and a signed acceptance. Build these items into the Statement of Work and the SLA, not as optional extras.

Practical actions that change outcomes:

• Mandate an estate inventory — hardware, cloud tenants, admin accounts and licences all recorded and timestamped.
• Include an exit clause with a funded remediation window and acceptance criteria.
• Require credential transfer or a zero-trust rotation: handover tokens, not passwords.
• Schedule joint verification sessions where both suppliers and a named client representative sign off.
• Document data flows and processors; when personal data is involved, clarify controller/processor roles (see the ICO guidance).

One well-placed external reference helps when you need leverage: the ICO publishes practical guidance on data controller responsibilities and third-party processors, which you can cite when defining who must retain or transfer data access (ICO). A clear exit clause plus an agreed inventory turns onboarding from guesswork into a short, auditable project.

Concrete examples:

• A services contract that required a two-week paid exit window produced a complete asset list and removed eight orphaned admin accounts before the new MSP made changes.
• Adding a single acceptance test — “incoming team has two MFA-enabled global admins” — removed a common blocker and reduced downtime during the first change window.

If you’re switching supplier this quarter, insist on a one-page handover checklist, a funded remediation block and a signed acceptance before you cancel the old contract; that step alone often recovers lost time and prevents billing disputes.

Related reading

• How Much Should Local IT Support Cost (with Pricing Benchmarks)
• Why Small Businesses Break Systems Faster Than Enterprises — Fewer Processes, Faster Change
• What a Good IT Support SLA Looks Like (With Real Examples)
• When Should Your MSP Choice Be National (Not Local)

FAQ

How long does a clean MSP handover usually take in the UK?

Expect a clean handover to take around 2–6 weeks for organisations of 10–200 staff; the range depends on cloud complexity, number of domains and how many licences need reconciliation.

What should I insist on in the contract to stop inherited chaos?

Insist on an exit clause that includes a funded remediation window, an asset inventory, verified admin transfer and acceptance criteria signed by the client — make acceptance conditional before the old supplier is offboarded.

Can an incoming MSP change passwords and access straightaway?

They should only after an agreed verification process: document existing admins, use time-limited tokens where possible and rotate credentials in a controlled change window to avoid service breaks and maintain audit trails.

How much does it cost to fix an inherited messy estate?

Remediation fees vary, but many suppliers charge a fixed remediation block; budget commonly between £1,500 and £7,500 depending on complexity, with clearer estates at the lower end.