Many small businesses discover, usually at the worst moment, that their IT provider controls everything: the domain, the DNS, the email tenant and the admin passwords. Leaving the provider then feels risky, so people stay.

It doesn't have to be. Done in the right order, taking back your email is a quiet weekend job with no lost messages. This guide covers Microsoft 365 and Google Workspace; the principles are the same for both.

First, work out what you're actually dealing with

Most situations fall into one of three cases. Which one you're in changes the whole plan.

Your situation What it means The job
A. You own the tenant, they administer it Your Microsoft 365 or Google Workspace account is in your company's name, but the provider holds the admin access Take back admin access and billing. No mailbox move needed.
B. They own the tenant Your mailboxes sit inside an account the provider owns or resells Set up your own tenant and migrate mailboxes across.
C. They control the domain or DNS The domain is registered in their name or account, or they host your DNS Get the domain and DNS into your control first, before anything else.

Many businesses are in more than one case at once. Fix them in the order C, then A or B.

Step 1: Build the inventory

Before you contact the provider, gather:

  • Domain registration. Who is the registrant? Which registrar? Look it up and check the renewal date.
  • DNS host. Where are the DNS records managed? Export or screenshot every record: MX, SPF, DKIM, DMARC, autodiscover, verification TXT records and anything for your website.
  • Email platform. Microsoft 365, Google Workspace or something else, and whose name the account is in.
  • Admin accounts. Which accounts have admin rights, and who holds the passwords and the multi-factor devices.
  • Billing. Who pays for licences, and whether your licences are bought through the provider.
  • Everything else on the domain. Website, shared mailboxes, distribution lists, scanners and apps that send email, and any third-party services verified against the domain.

Step 2: Secure the domain (case C)

The domain is the key to everything. Without it, nothing else is truly yours.

  • Ask the provider to change the registrant to your company, or to give you the transfer code so you can move it to a registrar account you own.
  • If they host your DNS, recreate every record at your new DNS host before you change nameservers. Compare the two side by side, record by record.
  • Lower the TTL on key records a day or two before any change, so you can correct mistakes quickly.

Step 3a: Take back admin access (case A)

  • Create a new global admin account for your business, protected with multi-factor authentication on a device you control.
  • Review and remove the provider's admin accounts once you have working access.
  • In Microsoft 365, review the partner relationships in the admin centre and remove delegated access you no longer want. In Google Workspace, review admin roles and any reseller relationship.
  • Move billing and licences to a subscription in your name, or transfer them to a new partner.
  • Change the passwords on shared and service accounts the provider may know.

Step 3b: Migrate to your own tenant (case B)

This is the bigger job, so plan a cutover window, usually a Friday evening.

  1. Create your own tenant and buy licences for every user.
  2. Prepare users and mailboxes in the new tenant, with the same names and addresses.
  3. Copy mail in advance. Use a migration tool to copy mailboxes, calendars and contacts while users keep working on the old system. Copy most of the history days before the cutover.
  4. Cutover. At the agreed time, remove the domain from the old tenant, add and verify it in the new one (a domain can only be verified in one Microsoft 365 tenant at a time), then switch the MX and related records.
  5. Final sync. Run a last copy to catch messages that arrived during the switch.
  6. Reconnect devices. Users sign in on phones and Outlook with their new account. Prepare a one-page guide for them.

Step 4: Protect deliverability

Email that arrives is as important as email that sends.

  • SPF lists every service allowed to send as your domain. Update it for the new setup and remove the provider's entries once they're no longer needed.
  • DKIM signing must be switched on for the new tenant.
  • DMARC should be in place, at least in monitoring mode, so you can see who is sending as you.
  • Send test emails to Gmail and Outlook addresses and check they land in the inbox, not spam.

Step 5: Tidy up

  • Keep the old mailboxes, read-only, until you're sure nothing was missed. Check what the provider's contract says about how long they'll keep data.
  • Update anything that still points at the old setup: scanners, website forms, accounting systems sending invoices.
  • Write down where everything now lives, with the admin accounts and renewal dates, and store it somewhere safe.

Common mistakes

  • Changing nameservers before copying every DNS record. The fastest way to lose email and your website at once.
  • Leaving MFA on the provider's phone. You'll be locked out of your own admin account.
  • Cutting over midweek. Give yourself a quiet weekend to fix surprises.
  • Forgetting the scanner. Devices and apps that send email are always the last thing to break.
  • Burning bridges too early. You'll probably need the outgoing provider's cooperation for a few days. Keep it friendly.

Want a hand?

We help small teams take back control of their domains, email and systems, and then automate the work that runs on top of them. Book a call if you'd like a second pair of eyes on your plan.