What Happens When Your IT Person Resigns: The 90-Day Risk Window

Your sole internal IT person hands in their notice on a Tuesday afternoon. The next 90 days will quietly expose every undocumented decision, shared login, and unwritten vendor relationship they were holding together. Most Melbourne SMEs discover within a fortnight that they have no idea what their IT person actually did, and the cost of that ignorance compounds fast.

The shape of the problem

If you are running a 30 to 150-staff business in Melbourne with a single internal IT person, your operational risk is almost certainly higher than your insurer thinks it is. That person is the firewall, the documentation, the vendor relationship manager, the backup verifier, and the person who knows that the printer on level 2 has its own static IP because someone in 2019 wired it badly and nobody has fixed it since. When they resign, none of that lives anywhere else.

We have walked into this scenario more times than we can count since founding TechAssist in 2014. The pattern is consistent enough that we now treat it as a defined transition project rather than a panic. The 90-day window splits cleanly into three phases, and how you handle each one determines whether the next IT model you adopt is built on knowledge or built on guesswork.

This post walks through that window honestly. We will not pretend the handover is clean, because it almost never is. We will name the mistakes that bite later, lay out a realistic cost comparison for the three paths forward, and tell you what to do in the first 48 hours that will save you the most pain.

Week 1-2: Knowledge dump and credential capture

The clock starts the moment notice is given. Your departing IT person is, depending on the relationship, either genuinely trying to leave things tidy or already mentally checked out. Either way, the goal of the first fortnight is to extract every piece of operational knowledge from their head and every credential from their personal devices before they walk out the door.

The credential audit comes first

Before anything else, you need a complete list of every system the business uses, who owns the admin account, and where that credential is stored. In practice, most SMEs discover their IT person has been the sole holder of admin credentials to:

• The Microsoft 365 global admin account, often tied to their personal mobile for MFA
• The domain registrar (frequently a personal GoDaddy or Crazy Domains account from years ago)
• The DNS provider, which may or may not be the same as the registrar
• The firewall management console, with the vendor portal login on a Post-it note
• The NBN or fibre service account, registered to their personal email
• Backup software portals, antivirus consoles, RMM tools if they ran one
• Line-of-business application admin accounts

The MFA problem is the one that catches people. Personal phone-based MFA is the single most common landmine we find. If your departing IT person’s mobile is the second factor for your Microsoft 365 global admin, and you do not transfer that before they leave, you are one factory reset away from being locked out of your own tenant. Microsoft’s account recovery process for global admin lockouts is slow, painful, and requires documentation most SMEs cannot produce on demand.

Document the undocumented

The other priority for week 1-2 is sitting down with the departing engineer and walking through the actual environment. Not what is in the wiki, what they actually do day-to-day. The questions that produce the most value:

• What automations or scripts run on a schedule? Where do they live?
• Which vendor support contracts exist, when do they renew, and who is the named contact?
• What is the backup routine, where are backups stored, and when was the last successful restore test?
• Which servers or services are running on hardware that should have been replaced years ago?
• What workarounds exist that nobody else knows about?
• Which staff have local admin rights they should not have, and why?

A Caulfield-based legal practice we onboarded last year had their sole IT manager resign after 11 years. During the knowledge dump, he casually mentioned that the practice management database was being backed up by a PowerShell script he wrote in 2016 that ran on his personal laptop because the server scheduled task had stopped working in 2019 and he had not got around to fixing it. The firm had been one stolen laptop away from losing seven years of matter records without realising it.

Week 3-6: Vendor relationships and the ‘who pays for what’ audit

Once you have credentials and a working operational picture, the second phase is harder and less satisfying. You need to map every vendor relationship, every recurring charge, every Master Services Agreement, and every handshake deal your IT person ever made. This is the phase that tends to drag, because the information is fragmented across accounts payable, the IT person’s email folders, and the memories of long-tenured staff.

The vendor map

Start with the bank statements and the accounting system. Pull 12 months of card transactions and supplier invoices. Categorise every IT-related charge. You will find:

• SaaS subscriptions nobody uses anymore
• Hardware leases that auto-renew next quarter
• Support contracts on equipment that was decommissioned
• Domain renewals you did not know existed
• Monthly retainers to small contractors for specific systems
• Cloud bills (AWS, Azure) that have been growing 8% per quarter without anyone noticing

For each vendor, you want the named contract, the renewal date, the named contact, and the escalation path. Most SMEs find at least 5% of IT spend is going to things that no longer deliver value. For a business with $80,000 annual IT spend, that is $4,000 a year sitting in dead subscriptions.

The MSA discovery

Master Services Agreements with key vendors are often signed once, filed badly, and forgotten. When your IT person leaves, you need to know:

• What service levels are you actually entitled to?
• What are the notice periods if you want to terminate?
• Are there minimum spend commitments?
• Who has authority to raise priority support tickets?

For businesses considering a move to a managed IT services arrangement, this audit is non-negotiable. You cannot transition into a managed model cleanly without a complete picture of existing commitments. We have seen incoming MSPs surprised by 18-month telco contracts that the previous IT person signed without anyone realising.

Week 7-12: Decide the path forward

By week 7, you have credentials, documentation, and a vendor map. Now the actual strategic decision: replace, co-manage, or fully outsource. This is where most SMEs default to ‘replace like-for-like’ because it feels safest, but it is rarely the cheapest or the most resilient option.

Option 1: Replace internally

Hire another internal IT person. This is the path of least change but the highest single-point-of-failure risk. You are rebuilding the same fragile structure you just discovered the cost of. If you go this route, your new hire should inherit not only the credentials but also a contract clause requiring all admin access to use organisational MFA, all credentials to be stored in a business password vault, and all documentation to live in a business-controlled system. That is the bare minimum to avoid repeating this exercise in three years.

Realistic Melbourne salary for a competent internal IT generalist who can cover infrastructure, end-user support, and basic security is $90,000 to $115,000 including super, plus tools, training, and the productivity gap during recruitment (typically 3-4 months).

Option 2: Co-managed IT

Keep an internal person, but layer an MSP underneath them for the heavy lifting: 24/7 monitoring, after-hours coverage, escalation for complex problems, vendor management, and the security stack. The internal person focuses on what they are best at, which is usually being close to the staff and the business. This model works well for businesses with 50 to 250 staff who have a meaningful in-house IT need but not enough work to justify a team of three.

Our co-managed IT support model is designed for exactly this scenario, and it is often where businesses land when they have just lost a sole IT person and want resilience without complete outsourcing. The internal hire is junior to mid-level (so cheaper), the MSP carries the senior expertise and after-hours risk, and the business gets two layers of redundancy.

Option 3: Fully outsource to an MSP

No internal IT person. All support, infrastructure, security, and strategy moves to an MSP under a per-user fixed monthly contract. This is the right answer for most businesses under about 80 staff, and increasingly for businesses up to 150 staff who do not have specialist needs.

The economics are straightforward once you do the maths. A 60-staff Melbourne business paying $105,000 fully-loaded for an internal IT person, plus $25,000 in tools and licences they manage, is spending $130,000 a year for one person who takes leave, gets sick, and cannot cover after-hours. A per-user fixed monthly MSP arrangement for the same business typically lands between $110 and $160 per user per month depending on inclusions, which puts the spend in the $80,000 to $115,000 range with a contracted service level behind it. You also get the security stack, 24/7 monitoring, and a team rather than a person.

TechAssist runs a 24/7 NOC at our Tecoma office, which means when something breaks at 2am, somebody Australian is already looking at it. We also operate a CBD office at 575 Bourke Street, which matters if your staff are in the city and you want same-business-day on-site response across Melbourne metro. Our 13 Australian engineers cover the work that one internal person cannot, and our sub-15-minute P1 response target is contractual, not aspirational. If you want to choose an MSP in Melbourne properly, this is the question to ask: what is the contractual response time, and what happens if it is missed?

Realistic cost comparison: three paths

The numbers below assume a 60-staff Melbourne business with a typical mix of office and field workers, Microsoft 365 Business Premium, a small server footprint, and standard security needs. Adjust for your context, but the relative shape holds.

The outsourced option is cheapest on paper, but the right answer depends on the business. A manufacturer in Dandenong South with heavy line-of-business software and a real shop-floor IT footprint might genuinely need an on-site person. A professional services firm in Hawthorn with 40 staff almost certainly does not.

Offboarding mistakes that bite later

These are the recurring patterns we see in the second year after a sole IT person leaves. None of them are dramatic. All of them are expensive.

Shared admin accounts

The departing IT person had a personal admin account they used for everything. When they left, somebody changed the password but did not disable the account. Six months later, an attacker who phished those credentials in 2023 finally gets around to using them. The audit log shows the admin account was used, but nobody knows which human pressed which key. Disable departing admin accounts. Do not just rotate the password.

Personal phone-based MFA

Already covered above, but it bears repeating because it is the single most common failure mode. Every MFA factor needs to be on a business-controlled device or a business-controlled mechanism (such as a security key held by the business, or a service account authenticator app on a business device).

Undocumented automations

Scripts, scheduled tasks, Power Automate flows, Zapier workflows, all running quietly in the background, all created by the departing person, none of them documented. The first failure happens nine months later when something breaks and nobody can find the source. Audit every scheduled task on every server, every Power Automate flow in the tenant, and every connector in any iPaaS tool. Document what each does, who owns the business outcome, and what happens if it stops.

Vendor portals registered to personal emails

The Telstra account, the Microsoft partner relationship, the AWS root account, the domain registrar, all created in 2017 using a personal Gmail address because it was faster than waiting for IT to set up a shared mailbox. Hunt every one of these down before the departing person walks out. Once they are gone and the vendor only accepts identity verification via that personal email, you have a multi-month problem.

Local admin rights on workstations

Many sole-IT-person businesses run with local admin rights distributed liberally. The IT person gave it out as a workaround for software installs and never took it back. This is a security problem that needs fixing during the transition, not after, because incoming MSPs will see this as a red flag and either price it in heavily or refuse the engagement. Restricting local admin is also one of the Essential Eight controls that the ACSC has been pushing for years.

What to do in the first 48 hours

If you are reading this because your IT person just resigned, here is the order of operations for the first two days. Everything else can wait.

1. Change the Microsoft 365 global admin password and MFA factor. Today. Use a business-owned phone or hardware token.
2. Add a second global admin account belonging to a director, with separate MFA, as an emergency access account.
3. Pull a list of all admin role assignments in Microsoft 365 and document which humans hold which roles.
4. Identify the domain registrar and DNS provider and confirm the business has account control. If not, start the recovery process immediately.
5. Engage a transition partner if you do not have internal capacity for the next 11 weeks of work. This is not a normal-business-week task.

If you want help running this transition cleanly, that is the bread and butter of our Melbourne MSP practice. We have done it dozens of times. The pattern is repeatable. The mistakes are predictable. The 90 days will pass either way.

Frequently Asked Questions

How long should the notice period be for a sole IT person?

Contractually, whatever your employment agreement says, usually four weeks. Practically, you want to be in a position where you could survive a one-day departure if the relationship turned sour. That means documentation, credential capture, and a transition plan ready to execute. If you only have the standard notice period and no plan, four weeks will not be enough.

Should we let the departing IT person help us choose the replacement?

Generally, no. Their incentives and the business’s incentives are not aligned. They may favour a friend, or push toward a model that protects their professional reputation rather than what fits the business. Use the departing engineer for knowledge transfer, not for vendor selection.

What if the departing person was a contractor, not an employee?

The risk profile is similar but the legal lever is different. Contractors usually have weaker IP and confidentiality protections by default unless the contract was written carefully. Check the contract for credential ownership, work product ownership, and data handling clauses. If the contractor was using their own tooling (their RMM, their backup software, their monitoring), you need to migrate off that tooling before they leave, not after.

Is co-managed IT just outsourcing with extra steps?

No, and this is a common misconception. Co-managed works because the internal person handles the relationships, the business knowledge, and the ground-level support, while the MSP handles the depth, the after-hours, the security stack, and the senior expertise. The internal person is the face. The MSP is the backbone. It works for businesses that have enough IT work to keep one person busy but not enough to justify a team.

How does the Essential Eight fit into all of this?

The Essential Eight is the ACSC’s baseline cybersecurity framework, and it is becoming a de facto expectation for Australian SMEs working with government, financial services, or healthcare clients. A sole IT person rarely has the bandwidth to implement and maintain all eight controls properly. The transition out of a sole-IT model is a natural moment to assess your cybersecurity posture against the Essential Eight and pick a path forward that closes the gaps.

How quickly can an MSP take over from a departing internal IT person?

For a clean transition, six to eight weeks from contract signature to full handover is realistic. We have done faster in emergency scenarios, but the work suffers. The first two weeks are discovery and credential transfer, the next two weeks are tooling deployment and policy alignment, and the final two to four weeks are co-running while the departing person is still available for questions. If you are starting that conversation, do it the week the resignation lands, not the week before the person leaves.

An internal IT team overwhelmed by demand looks like this: a growing ticket backlog, the same problem fixed for the third time this month, projects perpetually “next quarter”, and a senior tech who hasn’t taken a proper holiday since 2023. Work gets done — barely — but nothing improves.

If that sounds familiar, you’re not alone. We see it constantly across Melbourne — particularly in firms that grew from 30 staff to 120 over a few years without rebuilding the IT function to match. This article is for business owners, GMs and CFOs who already have an internal IT team of one to three people and are starting to notice the cracks. It’s a different problem from businesses with no formal IT support at all — those firms need a starting point. You need to fix something that’s already there.

Why this matters now

An overwhelmed internal IT team is one of the most expensive problems in a mid-sized business, and it’s almost always hidden. The salaries are already paid. The tickets are eventually closed. From the outside, IT looks “fine.” But underneath, three things are happening: security work is being skipped, your best technical person is quietly burning out, and the business is paying senior-engineer wages for help-desk work.

None of that shows up on a P&L line until something breaks. Then it shows up as a ransomware incident, a key resignation, or a $90,000 project that overruns by six months.

What “overwhelmed” actually looks like

Forget the abstract definitions. Here are the observable signs we walk into when a Melbourne business calls us about co-managing their IT.

1. The ticket backlog never shrinks

Healthy internal IT teams clear what comes in each week, with a slow-burn project queue running underneath. Overwhelmed teams have a backlog that grows steadily — 40 open tickets becomes 80, then 150. The team isn’t lazy. They’re triaging the loudest problem, fixing it, then moving to the next loudest. Nothing strategic gets touched.

A useful test: ask your IT manager how many tickets are older than 30 days. If they don’t know, or the number is above 10% of monthly volume, you have a capacity problem.

2. Projects have been “next quarter” for a year

Server replacement. Entra ID tenant cleanup. Backup verification. Migrating off that one legacy app nobody wants to touch. These projects sit on the roadmap because everyone agrees they’re important, but the team is too busy fixing today’s problems to start them. This is the clearest sign that the day-to-day load has consumed the team’s strategic capacity.

3. Security work is the first thing to get skipped

Patching schedules slip. MFA rollouts stall at 70%. Conditional access policies never get tightened past the defaults. The internal team knows it matters — they’re not negligent — but security work is usually invisible until it isn’t, so it loses every battle for time against a user who can’t print.

4. Everything breaks when Mark goes on holidays

Key person dependency is the dead giveaway. If your senior tech takes two weeks off and the team can’t function — passwords can’t be reset for certain systems, the firewall config is a mystery, nobody else knows how the backup actually works — you don’t have an IT team. You have one person and some helpers. This is fragile and it gets worse over time, because Mark stops documenting things he doesn’t have time to document.

5. Documentation is non-existent or three years stale

Ask to see the network diagram. Ask where the admin credentials are stored. Ask for the runbook on restoring email if the tenant goes down. If the answer is “it’s in Mark’s head” or “we had one but it’s old,” your team is past capacity. Documentation is the first thing that goes when people are flat out, and the absence of it makes everything slower.

6. After-hours work has become routine

Patching on Saturday nights. Answering Teams messages at 9pm. The senior engineer logging in from home on Sunday to fix the accounting export before Monday morning. Occasional after-hours work is part of the job. Routine after-hours work means the team is doing two jobs in one week and one of them is being done on personal time. It ends in resignation, usually with three weeks’ notice.

7. Your IT manager is doing tier-1 tickets

If the person you hired to run IT strategy is resetting passwords and unjamming printers, you’re paying $140k for $60k work, and the strategy isn’t happening. This usually means the team is short one or two technicians and the manager has been absorbing the gap.

8. Vendors are managing the team instead of the other way around

The internet provider, the phone system vendor, the line-of-business app support team — they’re all calling the shots about when things happen, because the internal team doesn’t have time to push back or coordinate. You start finding out about changes after they happen.

A concrete example

A professional services firm in South Yarra came to us last year. About 85 staff, two internal IT people — a manager and a junior. On paper, that’s a reasonable ratio. In practice, the manager was working until 7pm most nights, taking calls on weekends, and hadn’t started the Microsoft 365 security baseline project that had been approved 14 months earlier.

The junior was good but couldn’t operate without supervision on anything past tier-1. When the manager took annual leave over Christmas, the firm had three outages in two weeks because nobody else knew the environment.

The owner’s first instinct was to hire a third person. That would have helped, eventually — but the recruitment timeline alone was three to four months, and onboarding another six weeks before they were useful. Meanwhile the manager was 90 days from resigning. We don’t say that hypothetically; he told us so on the second meeting.

We ended up co-managing with them. Our team took over the after-hours load and the tier-1 ticket queue. Their manager kept ownership of strategy and the relationship with the business. Within six weeks the backlog was down 70%, the security project was running, and the manager was taking weekends off again. He’s still there.

Your three real options

When an internal IT team is overwhelmed, there are realistically three responses. The honest answer is that the right one depends on your situation — there’s no universal best.

When hiring is the right call

If your business is genuinely growing — adding 20+ staff per year, opening new sites, expanding the application stack — and you’ve got the management bandwidth to onboard and supervise, hiring is often correct. A third internal tech who knows the business deeply is worth a lot. Just be honest about the timeline. You’re not going to feel relief for six months.

When promoting works

Sometimes the team is fine but the structure is wrong. The senior tech is doing manager work informally, the junior is ready for more, and a quick reshuffle plus clearer responsibilities solves 60% of the problem. This works best in smaller teams where the issue is role ambiguity rather than headcount.

When co-managed makes sense

If your internal team is solid but drowning, co-managed IT is usually the fastest way to relief. The MSP takes over the predictable, repeatable work — tier-1 tickets, after-hours coverage, patching, monitoring — and your internal team gets back to the strategic work they were hired for. Done well, your manager keeps their job satisfaction and your business keeps the institutional knowledge.

This isn’t the same as fully outsourced managed IT, which replaces the internal team. Co-managed augments them. The distinction matters when you’re talking to staff about what’s changing.

What to look for in an MSP if you go co-managed

If you do head down the co-managed path, the wrong MSP will make your problem worse. They’ll squabble with your internal team over territory, fail to document what they do, and slowly position themselves to replace your internal staff. The right MSP behaves like a senior colleague to your IT manager, not a competitor.

• Australian-based engineers. Co-managed only works with tight collaboration, and that’s harder across time zones. TechAssist runs with 13 engineers, all Australian-employed.
• Real after-hours coverage. Not a voicemail and a callback. Our 24/7 Network Operations Centre at Tecoma in the Dandenongs handles overnight monitoring and incident response, which is exactly the load that’s killing your internal team.
• Fast response on critical issues. We target sub-15-minute response on critical tickets. If your internal team knows that backup is there, they sleep better.
• Clear scope. You should be able to draw a line between what the internal team owns and what the MSP owns, and update it as things evolve.
• Documentation discipline. The MSP should be feeding documentation back to your team, not hoarding it as job security.

If you’d rather discuss your specific situation, our team in Melbourne is happy to have a no-pressure conversation. Call 1300 028 324 or use the contact page. We’ve been doing this since 2014 and we’ll tell you honestly if co-managed isn’t the right fit.

What not to do

A few patterns we see that don’t end well:

• Hiring a junior to “help” a drowning senior. The senior now has less time, because they’re supervising the junior, and the junior can’t take work off their plate for six months.
• Buying tools instead of capacity. A new RMM platform or ticketing system doesn’t fix the problem. It just gives you better visibility into the backlog.
• Asking the team to “be more efficient.” They’re already running flat out. Telling overwhelmed people to work smarter is how you get a resignation.
• Ignoring the documentation gap. If you don’t fix it, the day Mark resigns is the day you discover what you don’t know.

How to decide

Pick a quiet week and do three things. First, sit with your IT manager for an hour and ask them honestly what they’d change if they could. Second, look at the ticket data — volume, age, recurrence. Third, look at the project roadmap and ask which things have been on it for more than six months and why.

If the answers point to “we need a person who can take ownership of this whole function long-term,” hire. If they point to “we need predictable capacity now, especially after hours,” look at co-managed. If they point to “the whole IT function is broken and we don’t have anyone capable of running it,” that’s a conversation about fully outsourced IT support.

FAQ

How do I know if my internal IT person is overwhelmed or just bad at their job?

Look at trajectory. A good person who is overwhelmed will be doing things in the right order — critical first, easy wins next — and will be honest about what’s not getting done. A bad hire will be busy on the wrong things, defensive about backlog, and surprised by problems they should have seen coming. If you’re not sure, get an outside review of the environment. The state of documentation, patching and backups will tell you quickly.

Won’t bringing in an MSP make my internal team feel threatened?

It can, if you handle it badly. The framing matters. Co-managed IT is being introduced because the business has grown beyond what one or two people can sustain — not because the internal team has failed. The good ones are usually relieved. The ones who feel threatened often turn out to be the ones quietly hoping nobody finds out what they haven’t been doing.

How much does co-managed IT cost compared to hiring?

A mid-level Melbourne technician costs around $90-110k loaded once you add super, leave, training and overheads. Co-managed engagements vary by scope, but for a 50-100 staff business expect to spend less than a full-time hire while getting after-hours coverage, multiple skill sets and no recruitment risk. The honest answer is to get specific quotes against your environment.

Will my internal IT manager lose authority if we bring in an MSP?

Not if the scope is clear. In a proper co-managed setup, the internal manager owns strategy, vendor relationships and business context. The MSP owns execution capacity, after-hours coverage, and specialist skills they wouldn’t otherwise have access to. The manager becomes more effective, not less.

How fast can we actually get relief?

Faster than hiring. A reasonable co-managed onboarding is 4-6 weeks to fully embedded, but a good MSP will be absorbing tickets and after-hours load within the first two weeks. Compare that to a 3-4 month recruitment timeline plus onboarding. For a team that’s already burnt out, that gap matters.

The honest summary

An overwhelmed internal IT team is a solvable problem, but only if you name it early. The longer it runs, the more you lose — first in projects, then in security posture, then in your best person walking out the door. Hiring, restructuring and co-managed are all valid responses. Pick the one that matches your actual situation, not the one that feels least disruptive.

If you’d like a Melbourne-based perspective on which option fits your business, the team at TechAssist is happy to walk through it. We’ve been doing this since 2014 and we’d rather tell you honestly what we’d do than win work we shouldn’t have.