Your email works, your website is online and someone takes care of the renewals. That can make a simple question surprisingly hard to answer: if you needed to change IT providers, who in your business could actually get into those accounts?
Before a provider change, verify three things: whose organization the service belongs to, who can administer it, and how your business can recover access. Paying an invoice doesn't establish all three. Start with a documented, authorized access check while your current support relationship is still working. You don't need to move a domain or remove anyone's permissions to find out where the gaps are.
I’d rather see a business discover an unanswered question during a calm planning meeting than during an email outage. Here’s a focused check an owner or operations manager can bring to that meeting.
Separate ownership, access and billing
These are related questions, but they can have different answers.
A domain is the name people use to find your business, such as example.com. The registrar manages its registration. DNS is the set of records that directs visitors and email to the right services. Your website host, DNS provider and domain registrar might be three different companies.
For Microsoft 365, your tenant is your organization’s environment containing its users and services. Someone can sell the subscriptions, administer that environment, or do both. Microsoft explicitly distinguishes reseller relationships from administrative access: removing a partner’s admin roles does not end the partner relationship. Treat licensing, service agreements and administrator permissions as separate parts of a handoff. Microsoft’s partner relationship guidance explains that distinction.
That’s why “we pay the IT company for it” is a starting point, not a complete record. Ask for the actual account or organization identifier, the company named in the relevant records, the authorized administrators and the renewal arrangement.
Start with the domain, without changing it
Ask your authorized administrator to show you the registrar account and confirm that the expected domain is there. Review the registrant information available in the account, the renewal date, billing contact and the people authorized to manage it. Public lookup information can help identify a registrar, but it isn't a substitute for checking the account records with the authorized holder.
Then identify where DNS is managed and who can maintain it. Record the location of a protected configuration backup or export if one is available. The worksheet should point to that record, not expose sensitive configuration or passwords in an ordinary shared document.
An access check is not a domain transfer. Don't unlock the domain, change its nameservers or request a transfer merely to prove that somebody can sign in. ICANN documents transfer requirements and circumstances where a registrar transfer can be restricted, including certain 60-day locks. If a transfer is actually needed, plan it separately with the registrar and the authorized domain holder. ICANN’s transfer FAQ is a useful reference for that later conversation.
If the records name a former employee, a web designer or another organization, mark the issue unresolved. Ask the relevant holder and provider to establish the correct authority and documented next step. Don't assume that having a password settles ownership.
Check business administration separately from everyday email
Being able to open your inbox doesn't prove that your organization can manage its users, subscriptions or recovery settings.
For Microsoft 365, have an authorized administrator confirm the tenant identity, the business-controlled administration arrangements, and which partners have delegated access. Delegated access means the partner has been given permission to do specified administrative work. It should have an understood purpose and scope.
This doesn't mean every owner needs to use an all-powerful administrator account every day. Routine work and powerful administration should stay separate. Our guide to named accounts and shared logins explains why individual accountability matters.
The useful question for this review is narrower: if the person who normally handles administration is unavailable, what authorized route does the business have? Ask someone qualified to demonstrate the agreed access and show where the procedure is kept. Don't improvise by removing the current provider or granting broad permissions to everyone in the meeting.
Recovery needs its own check
A list of account names is incomplete if every recovery method depends on one person's phone or on the very email service you might lose access to.
Ask who is authorized to use the recovery process, what it depends on, where the protected instructions are kept and when it was last validated. Keep passwords, recovery codes and security-key details out of the worksheet. Record who holds the approved procedure and how authorized staff can reach it.
Microsoft recommends two or more emergency access accounts for Microsoft Entra ID, the identity service behind Microsoft 365. Its guidance covers strong authentication, protected credential storage, monitoring and regular validation. These accounts are a carefully controlled emergency route, not a shared everyday login. Have the responsible administrator assess the full Microsoft emergency-access guidance for your environment rather than treating a second password as the whole solution.
Don't deliberately lock anyone out to test a plan. Use an agreed, supervised validation procedure that preserves normal access and records the result. If the business cannot verify a recovery route, that becomes an action with a named owner and a due date.
Use this account-control worksheet
Complete one row for each important service. Put “unknown” where you lack evidence; it's more useful than an optimistic check mark.
| What needs confirming? | Evidence to review | Your record |
|---|---|---|
| Domain registration | Correct domain, registrar, registered holder and renewal arrangement | Owner: ___ Status/date: ___ |
| DNS and website | Where each is managed and who is authorized to maintain it | Owner: ___ Record location: ___ |
| Business email environment | Correct organization or tenant and authorized administration route | Owner: ___ Verified/date: ___ |
| Partner permissions | Current partner access, purpose and who approves changes | Owner: ___ Review/date: ___ |
| Recovery and emergency access | Protected procedure, authorized people and last supervised validation | Owner: ___ Next check: ___ |
| Licensing and billing | Supplier, renewal dates, service term and handoff responsibilities | Owner: ___ Unknowns: ___ |
Store the completed sheet where authorized business staff can find it. It is a map to the protected records, not a password vault. Keep the record current when the responsible person, provider or service changes.
A small example of why this matters
Imagine a 15-person property-management office preparing to change support providers. The owner receives the monthly email invoice, the web designer manages DNS, and the office manager knows the registrar login. During the review, they discover that the registrar’s recovery contact still points to someone who has left.
That’s a hypothetical example, not an IT MGMT customer story. The useful outcome is a specific action: work with the authorized holder and registrar to correct and verify the recovery arrangement before the handoff. They can keep their email and website running while resolving that gap. Moving every service at once would not answer the ownership question.
Bring the unanswered questions to the handoff meeting
For a business with 5–100 users, this worksheet can make the next conversation much clearer. You’ll know what has been verified, what depends on a particular person, and what still needs cooperation from a provider.
It complements our switching IT providers guide, which covers the wider transition, tool replacement and service responsibilities. It doesn't replace that plan or determine the terms of an existing agreement.
If you're unsure where to start, book a Business IT consultation and bring the questions, not your passwords. We can discuss the gaps and priorities. Any hands-on account assessment or changes are scoped separately, with the appropriate authorization.