A cloud exit that cannot name who holds the tenant, privilege, evidence, and revoke is still operated by the partner. The spreadsheet can show a lower bill. Custody is the part that decides whether the estate is yours.
Most MSP exits are priced as a transfer of tickets. The partner's runbooks move into a shared folder. A new landing zone is drawn. The monthly invoice drops. Six months later the same partner, or a new one, still creates the admin roles, still holds the only copy of the baseline, and still explains the audit sample. The cost moved. The operator did not.
Ne Plus Ultra treats the exit as four named owners. Each one is a person or a system inside the customer's control, with a backup, and with a test that can be run without the outgoing partner in the room.
The tenant owner
Someone inside the organisation must be able to lock the directory, the subscriptions, and the billing account without opening a ticket. That means the break-glass accounts, the billing role, and the agreement that owns the tenant sit with the customer on day one.
A partner-owned enrolment, a partner-held global admin, or a billing account that only the MSP can change is a lease. The first week of an exit produces a list of every identity that can still grant itself a privileged role, and that list is short enough to read aloud.
The privilege owner
Standing admin access is how an exit quietly fails. The partner's engineers keep a role until hypercare ends. Hypercare becomes the operating model.
Privilege has an owner who can see every eligible role, the ticket that opened it, and the time it must die. Just-in-time access is the mechanism. The test is simpler than the product name: pick one eligible administrator, end the window, and record how long the role still works. If the answer depends on the partner's service desk, the estate has not left. The measured version of that test is the revoke standard.
The evidence owner
Auditors accept a record of what the estate looked like, what changed, and what put it back. A slide that says the landing zone is compliant does not carry that record.
The baseline is a versioned description of the landing zone: policy, tags, network, and the identities allowed to change them. Drift is the difference between that description and the live estate. Evidence is the log of that difference and of the remediation. The owner of evidence is whoever can export that log without asking the MSP to generate it. If the only history lives in the partner's tooling, the customer owns a dashboard, not a control. That description is the baseline the later operating model has to keep.
The revoke owner
The last owner is the one who can cut the outgoing partner off. Contracts talk about transition assistance. Tenants still contain guest users, app registrations, service principals, and VPN profiles that nobody put on the exit checklist.
Revoke is a dated list. Guests, enterprise applications, management groups the partner can still see, and any pipeline identity that deploys from the partner's tenant. The test is performed once, on a role that does not take production down: remove it, confirm the partner cannot put it back, and keep the timestamp. An exit without that test is a hope that the old keys will go unused.
What the first month should produce
A serious first month is four artefacts, before any new landing zone is drawn.
- The tenant and billing owners, named, with break-glass tested.
- The privilege inventory, with one revoke timed and written down.
- The baseline, stored where the customer can read it, and one drift finding with its remediation.
- The partner cutoff list, with one identity actually removed.
Cost reduction is a consequence of that month. It is a poor opening promise. An estate that can show these four artefacts can hire a smaller operator, or run the control plane itself. An estate that cannot show them is still paying someone else to be the owner. The shape of that control plane is described under architecture.
If those four names are unclear in your tenant, start with the inventory.