# MSP Client Offboarding Checklist

Canonical guide: https://nizlo.com/guides/msp-client-offboarding-checklist

Last reviewed: October 31, 2026  
Publisher: Nizlo  
Use: Copy this tool-neutral template into a PSA, project board, or transition runbook. Adapt it to the signed agreement, applicable law, insurance requirements, client risk, and the receiving provider's readiness.

For every step, record:

- Owner
- Due date
- Status
- Evidence location
- Exception or risk owner
- Notes

Do not mark an unknown state complete. Keep a controlled recovery path until the receiving owner has proven access, management, recovery, and removal on representative systems.

## 1. Confirm authority, scope, and the exit date

- [ ] Name the client sponsor, outgoing owner, incoming owner, effective date, support boundary, and escalation contacts.
- [ ] List every in-scope tenant, site, device, service, domain, subscription, integration, and data store.
- [ ] Record legal holds, retention duties, insurance requirements, and contract-specific return or deletion terms before changing data.

## 2. Freeze scope and preserve transition evidence

- [ ] Export the authorized asset list, service inventory, open incidents, change history, patch state, alert state, backup status, and unresolved risks.
- [ ] Record active policies, monitors, scripts, schedules, exclusions, maintenance windows, and deployment rings.
- [ ] Identify important exports and store them in the approved transition location with a named custodian.

## 3. Inventory every identity and trust path

- [ ] Map each identity or credential to an owner, system, privilege, purpose, and revocation method.
- [ ] Include shared accounts, unattended-access identities, device credentials, webhook secrets, and cached sessions.
- [ ] Identify access granted through groups, federation, delegated administration, application consent, or upstream identity providers.

## 4. Transfer ownership before revoking access

- [ ] Verify the recipient can sign in, use MFA, receive recovery messages, and perform the required administrative action.
- [ ] Transfer documentation, vendor contacts, renewal dates, license quantities, and support entitlements through an approved channel.
- [ ] Use an agreed secure handoff for passwords or secrets and record receipt without copying the secret into a ticket.

## 5. Revoke people, sessions, credentials, and integrations

- [ ] Remove outgoing technicians and guests from client groups, roles, vaults, portals, VPNs, and delegated-administration relationships.
- [ ] Revoke sessions and refresh tokens, then rotate shared, service, API, webhook, recovery, and local-administrator credentials.
- [ ] Verify removed identities cannot authenticate through a direct URL, API, remote agent, cached session, or alternate tenant.

## 6. Stop automation without abandoning work in flight

- [ ] Inventory patch jobs, scripts, remediations, software deployments, reboots, reports, alerts, ticket rules, and backup schedules.
- [ ] Cancel or complete in-flight work deliberately; distinguish queued, running, completed, failed, cancelled, and unknown results.
- [ ] Remove secrets and provider-specific dependencies from transferred automation, or document why it cannot be transferred safely.

## 7. Transfer management authority service by service

- [ ] Assign a named authority for identity, endpoint management, RMM, EDR, backup, DNS, email, networking, certificates, and vendor portals.
- [ ] Test one representative device and one critical workflow under the receiving authority before wider cutover.
- [ ] Define the exact point when the outgoing system stops monitoring, patching, automating, backing up, and opening tickets.

## 8. Remove agents and remote-access components in waves

- [ ] Pilot removal on representative workstations, servers, offline devices, and systems with another management agent present.
- [ ] Verify services, processes, files, tasks, extensions, certificates, accounts, network listeners, and unattended-access records are removed as intended.
- [ ] Track devices that are offline, inaccessible, failed, excluded, or awaiting local action as open exceptions.

## 9. Return, retain, and delete data by rule

- [ ] Classify exports, logs, recordings, tickets, credentials, configuration backups, reports, invoices, and personal data by disposition.
- [ ] Record the location, custodian, access restriction, retention period, deletion trigger, and exception authority for retained material.
- [ ] Delete only after required transfer and hold checks pass, then preserve defensible evidence of disposition without retaining the deleted content itself.

## 10. Reconcile exceptions and obtain closeout acceptance

- [ ] Reconcile the final asset count against the baseline and receiving system; explain every difference.
- [ ] Test former access paths, alert delivery, management authority, backup responsibility, and emergency contacts after cutover.
- [ ] Record open exceptions, risk owner, compensating control, due date, evidence location, and final client or successor acceptance.

## Close only when

- [ ] Every managed asset has a verified receiving owner or exception.
- [ ] Former technicians and integrations cannot authenticate.
- [ ] Sessions, tokens, API keys, and shared credentials are revoked or rotated.
- [ ] No outgoing automation remains queued or scheduled.
- [ ] Each service has one documented management authority.
- [ ] Agent removal includes helper and remote-access components.
- [ ] Client data has a documented return, retention, or deletion state.
- [ ] Both parties can locate the final evidence and exception register.

## Citation

Nizlo. "MSP Client Offboarding Checklist." Last reviewed October 31, 2026. https://nizlo.com/guides/msp-client-offboarding-checklist