MSP handoff to managed IT for the mid-market.

Why mid-market firms outgrow their first MSP.

The MSP that fit a 60-seat office does not scale to a 600-seat, two-country operation. The arrangement that started as "call when something breaks" turns into a liability the first time payroll goes down over a weekend and the on-call engineer is at a wedding. The provider that answered quickly at 80 seats routes you through a ticket queue at 400, and the engineer who wrote your firewall rules three years ago has left. You are now paying for a reactive service that neither prevents incidents nor meets procurement's questions about SLAs, sub-processors, and EU data residency. The harder problem is the handover itself. Incumbent MSPs rarely volunteer documentation. The administrator passwords live on a laptop you do not own, the backup target is in a tenant you cannot see, and the only person who understands the VPN config bills by the hour. Switching without a plan loses a week of productivity. Switching with a plan is a project in its own right, and it is the project nobody on your team has time to run. A proper handoff is a managed engagement, not an email thread. It needs an inventory, a runbook, parallel coverage during cutover, and a signed SLA that starts the day the new provider owns the pager.

• Response is reactive: tickets open after users notice, not before monitoring does.
• No named on-call engineer: every incident is handled by a different person who does not know your estate.
• No written SLA: "best effort" is the contract clause, and procurement cannot defend it.
• No DACH presence or no US presence: your other geography is on 12-hour delay.
• Documentation lives in the incumbent's head: credentials, firewall rules, backup targets, and the one script that holds payroll together.

How we take over your estate without a coverage gap.

Six stages across 6 to 12 weeks, every one documented, every handover dated and signed.

1. 01

   Incumbent audit and inventory

   A senior engineer walks the estate (physical sites, cloud tenants, SaaS admin consoles, identity provider, backup targets, network edge) and produces a written inventory inside two weeks. Every asset gets an owner, a current state, and a flag for anything the incumbent has not disclosed.

2. 02

   Runbook capture, with or without incumbent cooperation

   We extract and rebuild runbooks for every production system: firewall rules, VPN config, DNS, DHCP, Active Directory and Entra, Microsoft 365 or Google Workspace, backup and restore, monitoring. If the incumbent cooperates, we take the handover; if they do not, we rediscover from the live estate and document from scratch. Either way you leave with a readable runbook you own.

3. 03

   Parallel coverage and shadow on-call

   For a minimum of 30 days, Deploris runs shadow on-call alongside the incumbent. We take the alerts, triage, and resolve or escalate; the incumbent remains contractually responsible for incidents during this window. Your users notice nothing. Your incident log doubles, and so does your audit trail.

4. 04

   SLA cutover and credential rotation

   On a scheduled change window, SLA responsibility moves to Deploris. Every credential the incumbent held is rotated: admin accounts, service accounts, API keys, VPN pre-shared keys, break-glass access. Nothing is left in the former provider's possession, and every rotation is logged against the inventory.

5. 05

   Steady state under written SLA

   Deploris operates the estate under a written service-level agreement: 15-minute median first-response on priority-one incidents, 99.9 percent monthly uptime target on the systems we operate, 48-hour reversibility on any change, named on-call engineer, weekly patching window, full audit trail.

6. 06

   Quarterly capacity and risk review

   Every quarter your leadership sits with the named account engineer to walk the metrics, the capacity trajectory, and the risk register. Changes to the SLA, the runbook, or the sub-processor list happen on the record, with 48-hour reversibility and a dated change log.

What to expect from any vendor doing an MSP handoff well.

If a competing vendor cannot meet all ten, you are buying another reactive MSP in better clothing.

• Senior engineers on the discovery call, not sales staff.
• A written inventory of every asset within two weeks, including anything the incumbent has not disclosed.
• A runbook rebuild path for the case where the incumbent refuses to hand over documentation.
• A minimum 30-day parallel coverage window where the incumbent remains contractually on the hook.
• A dated, logged credential rotation of every account the incumbent ever held.
• A written service-level agreement with specific first-response and uptime numbers, not "best effort".
• A named on-call engineer, not a ticket queue, and a documented escalation path.
• EU-region hosting option with a signed data processing agreement and a sub-processor list.
• A quarterly capacity and risk review on the calendar before you sign.
• 48-hour reversibility on any change the new provider makes, with a full audit trail.

What this looks like in practice.

A 320-seat industrial-manufacturing company with a headquarters in Baden-Württemberg and a plant in the US Midwest had been served by the same local MSP for nine years. The arrangement worked at 80 seats. At 320, with ISO 27001 on the roadmap and a US procurement team asking pointed questions about response times, it did not. The CIO described it as "they answer when I call, but I have to call". There was no monitoring, no documented runbook, no SLA, and the plant in the US had no coverage after 15:00 local because the incumbent closed at 18:00 Central European Time. We ran the audit in two weeks: 11 physical servers, 4 network sites, 1 Microsoft 365 tenant, 3 line-of-business apps, 1 backup target, and 2 credential vaults the incumbent had never shared. Runbook capture took another three weeks, half of which was spent reconstructing firewall rules from the live config because the incumbent would not export them. Parallel coverage ran for 42 days. SLA cutover happened on a Saturday change window. Every credential the incumbent held was rotated the same weekend. The estate now runs under a Deploris managed-IT contract with EU-region hosting for the services we provision, 24/7 coverage across both geographies, and a quarterly review on the CIO's calendar. The company name is withheld because the engagement is active and the procurement team prefers it that way.

Why Deploris, not the alternatives.

Four paths lead out of a reactive MSP: keep the incumbent and hope they grow up, swap them for a lower-cost provider on the same model, build an internal IT ops team, or hire a provider that both runs the infrastructure and already builds the custom software on top. Deploris is the fourth path.

Related reading