IT Admin Handover Checklist
An IT handover checklist for when your sysadmin changes: owner accounts, domain registrar, recovery codes, vendors, renewals and break-glass access.
- Typical schedule per admin change
- The checklist 4 sections, 19 items
- Variables
{{outgoing_admin}}{{incoming_admin}}
Use this checklist when the person who runs IT changes: the in-house sysadmin leaves, a co-founder hands over the admin role, or you move from one IT provider to another. It goes further than a normal offboarding, because this person holds the keys that everyone else depends on.
Who owns it
The incoming admin owns the run, and the outgoing admin works through it with them. A manager or founder should sign off the last section. Start while the outgoing admin is still around and cooperative. Several weeks of overlap is ideal.
Common pitfalls
- Accounts registered to a personal email. Domain registrars, DNS, cloud billing and app stores are often tied to someone's private address. Move them to a role address such as it@yourcompany before the handover.
- Single super admin. If only one person has the top role in the identity provider, losing them locks you out. Have at least two named admins plus a break-glass account.
- Recovery codes in one head. MFA recovery codes, the password manager's recovery kit and hardware tokens must be handed over, not just passwords.
- Renewals nobody watches. Domains and certificates expire on a date nobody remembers. List every renewal and point the reminders to a shared address.
- Knowledge without documentation. The outgoing admin knows why things are set up this way. Record it during the overlap, while they can still answer questions.
After the handover, rotate the credentials the outgoing admin knew, even when the parting is friendly.
The checklist: IT admin handover from {{outgoing_admin}} to {{incoming_admin}}
Inventory
-
List of admin and owner accounts compiled by
{{outgoing_admin}}Identity provider, email and office suite, cloud providers, domain registrar, DNS, firewall, Wi-Fi, MDM, backups, password manager.
-
List of vendors, contracts and support contacts with account numbers
-
List of renewals with dates: domains, TLS certificates, licences, hardware warranties
-
Network diagram and the location of servers, routers and access points documented
-
Undocumented scripts, scheduled jobs and manual routines written down
Transfer ownership
-
{{incoming_admin}}added as super admin or owner in each system on the list -
Domain registrar and DNS accounts moved to a role email address and company payment method
-
Billing and recovery email addresses changed to role addresses, not personal ones
-
Password manager admin role and recovery kit transferred
-
Hardware tokens and break-glass credentials handed over in person and their storage confirmed
-
A second named admin exists for the identity provider optional
Knowledge transfer
-
Walkthrough of backups, including one test restore done together
-
Walkthrough of monitoring and alerting: what fires, where it goes and what to do
-
Open tickets, known issues and planned changes handed over
-
Vendors and the support provider told about the new contact
Revoke and rotate
-
{{outgoing_admin}}'s admin roles removed in every system on the list -
Shared admin passwords and break-glass credentials rotated
-
API keys and service credentials created by
{{outgoing_admin}}reviewed and rotated optional -
Manager or founder signs off the handover
Checklist as Markdown
Frequently asked questions
What should be in a sysadmin handover document?
A list of every admin and owner account, vendors and contracts, renewal dates, a network overview, backup and monitoring setup, and undocumented routines. Add open issues and planned changes. The checklist above structures the work so nothing depends on memory.
How do I transfer admin accounts safely?
Add the new admin first, confirm they can sign in and perform admin tasks, then remove the old admin's roles. Move recovery emails and billing to role addresses. Finally, rotate any shared credentials the outgoing admin knew.
What if the previous admin is no longer available?
Start with the identity provider and the domain registrar, because they control everything else. Use the providers' account recovery processes, which usually require proof of domain or company ownership. Then work through the systems one by one, and document each as you regain control.
Updated