Can an MSP Shut Off a Client’s IT Services for Nonpayment?

What the managed services agreement must say before any service stops

The right to suspend starts in the signed agreement, not in the overdue invoice; without a written suspension right, stopping work is a legal judgment with exposure on both sides, and it belongs with the attorney. The architecture and engineering version of this guide reads a published industry form clause by clause. A managed IT firm reads its own template and any client paper it signed. Pull the signed agreement for every client with an invoice past terms and look for these items; a missing one is a point for the attorney before the next renewal.

• Payment terms: the due date, what starts the clock, and any late charge or interest allowed.
• A suspension clause: which services may pause, how many days past due, and after what written notice, delivered how and to whom under the notice clause.
• What continues during a suspension, named one by one: security monitoring, backups, patching, emergency response.
• Client access: that the client’s data, admin credentials and documentation stay available to it whatever the payment status.
• Licenses on an annual or longer commitment: that the client pays for them through the committed term, even if the agreement ends.
• Termination for nonpayment and the handover: what the firm transfers, in what form, how fast, and whether transition work is billed in advance.
• Who owns anything registered in the firm’s name for the client, such as a domain or a tenant.

Agreements change most easily at renewal, and the guide to managed services agreement auto-renewal notices covers those dates. A client that is a HIPAA covered entity, such as a dental or medical practice, adds a business associate agreement where the firm handles protected health information for it. Under 45 CFR 164.504(e), it must provide that the business associate will “Make available protected health information in accordance with § 164.524” and, at termination, “if feasible, return or destroy all protected health information” it still maintains. How a suspension clause sits beside those duties is a question for a healthcare attorney.

Why cutting a client’s access can become a computer-crime case

Holding the admin password is access. Whether the client permitted its use to lock its own people out is a separate question, and computer-crime statutes turn on that one: authorization, permission, consent. The federal text and three state codes, as they read on October 22, 2026.

Federal. 18 U.S.C. §1030(a)(5)(A) covers whoever “knowingly causes the transmission of a program, information, code, or command,” and as a result “intentionally causes damage without authorization, to a protected computer.” The statute defines “damage” as “any impairment to the integrity or availability of data, a program, a system, or information,” and its definition of “loss” includes “any revenue lost, cost incurred, or other consequential damages incurred because of interruption of service.” Subsection (g) adds a civil action where a listed factor applies, such as losses aggregating at least $5,000 in a one-year period. Subsection (a)(7) separately covers a communication sent “with intent to extort from any person any money or other thing of value” that contains a “threat to cause damage to a protected computer.”

California. Penal Code §502(c)(5) makes it a public offense to knowingly and without permission disrupt or deny “computer services to an authorized user of a computer, computer system, or computer network.” Subdivision (d)(1) makes that a felony or a misdemeanor, and subdivision (e)(1) gives the owner or lessee a civil action.

Florida. Section 815.06(2)(b) covers a person who, “willfully, knowingly, and without authorization or exceeding authorization,” “Disrupts or denies or causes the denial of the ability to transmit data to or from an authorized user” of a computer, system, network or device that is “owned by, under contract to, or operated for, on behalf of, or in conjunction with another.” Under subsection (3), that is a third-degree felony, and a second-degree felony where, among other cases, the act damages a computer, system or network and the damage or loss is at least $5,000.

Texas. Penal Code §33.02(a) makes it an offense to knowingly access a computer, network or system “without the effective consent of the owner,” and §33.01 says consent is not effective if it is “used for a purpose other than that for which the consent was given.” Section 33.022 makes it a third-degree felony to intentionally interrupt or suspend “access to a computer system or computer network without the effective consent of the owner.” It excludes “a network provider or online service provider acting for a legitimate business purpose,” and whether a managed IT firm fits that phrase is a question for the attorney.

Read against those texts, these are the acts to clear with the attorney before anyone does them, whatever the balance:

• Changing, withholding or revoking the client’s admin credentials for its tenant, domain registrar, firewall, servers or line-of-business software.
• Disabling user accounts, mailboxes or devices, or pushing a script or policy through the RMM that blocks logins.
• Deleting, encrypting or moving the client’s data or backups, or letting a retention period run out on them while the balance is in dispute.
• Changing DNS, mail routing or domain records so that email or a website stops working.
• Turning off security monitoring, endpoint protection or backups without written notice and a handover, which leaves the client exposed rather than merely unserved.
• Sending any message that makes restored access conditional on payment.

Each act on that list goes to the firm’s attorney first, even where the agreement seems to allow it. The firm’s leverage in a payment dispute is its own work, not the client’s systems.

The suspension notice: what it says, who sends it, and when

A suspension notice gives the client a last clear chance to pay, with no surprise about what happens if it does not. It goes out under the agreement’s notice clause, signed by the owner, with proof of delivery filed in the client record, from a template the attorney approved once. It holds:

• The invoice numbers, dates and amounts past due, and the total.
• The section of the agreement that allows suspension, quoted.
• The date suspension would start, counted under the agreement’s notice period.
• Exactly which services pause, and which continue, such as emergency security response and backups.
• A plain statement that the client’s data, accounts and admin access are not affected.
• How to pay, and the name and direct line of the person who can agree a payment plan.

Illustrative example, with invented days for a hypothetical agreement with a 10-day notice period: on day 1 past due, an automatic reminder; on day 7, a call from the account manager; on day 15, an owner-to-owner call, confirmed in writing; on day 30, the notice goes out in the wording the attorney approved; on day 40, the notice period ends and the services named in it pause. The client’s systems stay untouched at every step. The firm’s agreement and attorney set the real days.

The collection steps that come before any suspension

Before anyone drafts a notice, find out why the invoice is unpaid. A seat count the client disputes is a billing error to fix. An invoice without the client’s purchase order number may be stuck in its accounts payable queue. A client short of cash is a payment-plan conversation. Only a client that has stopped answering, or says it will not pay, is on the path to a notice.

The steps before suspension run from one list, kept every Friday by a named person:

• Each client invoice past terms: amount, days past due, who is following it up, last contact, promised payment date.
• Calls before letters: the account manager first, then owner to owner, and any payment plan in writing, with dates.
• No new credit while the balance is open: hardware, project work and new licenses on prepayment only.
• For a client at risk, new Microsoft licenses on a monthly term, the option Microsoft’s own cancellation policy names for a customer “considered a risk for payment default or insolvency.”
• Any late charge the agreement allows, computed and shown on the statement, or waived on purpose with a note in the file.
• Only then, where the agreement allows it and the attorney agrees, the suspension notice, and after it, termination with an orderly handover.

The licenses belong on the list because the firm’s own bill does not stop. Microsoft’s new commerce cancellation policy says “The partner is responsible for payment of any outstanding amounts regardless of whether the customer can’t pay or refuses to pay for the subscription,” including after a commercial disagreement with the partner. So the firm keeps paying for the seats left on an annual commitment until they renew. Illustrative example, with invented numbers: a client 75 days past due on $9,000 of fees also holds 30 annual seats at $20 a month with six months left, so the firm carries $3,600 of Microsoft charges for them whether or not the client pays. That figure belongs next to the open invoices when the owner decides what to do.

Does the same apply to SaaS access?

Yes, the same split applies, with one difference: in the cloud, the provider’s off switch and the client’s data sit on the same screen.

For a resold Microsoft subscription, Partner Center’s page on subscription lifecycle states describes a Suspended state a partner can set “to temporarily disable the services to customers,” and says it “may help in dunning scenarios since users can’t access files and services, although customer administrators can access data.” It also says: “Partners continue to be billed when a subscription is suspended.” What the firm still owes on those seats, and when it can reduce them, is in the guide to NCE seats after a user leaves. The page describes what the button does, not whether a client agreement lets the firm press it. That is the attorney’s question, and the people who lose their files are the client’s users, so the statutes above belong in it.

A suspension also starts a clock. If the subscription is still suspended at the end of its term, the page says it moves to a 30-day disabled state, then a 90-day disabled state in which “only admins can access the data,” then to deleted: “The subscription is nonrecoverable.” Microsoft’s page on the end of a Microsoft 365 for business subscription adds that after deletion, “adding a new subscription of the same type doesn’t restore the data.” A suspension nobody puts on a calendar can end with the client’s data gone.

For a software company billing its own product, the order form and terms of service decide when access may pause, and the billing settings decide what happens on the day a payment fails; the two should agree. The customer’s stored data is the second list again: what the terms say about export, and for how long after access ends.

When not to hire anyone for this, and where the Review fits

If one client is late and the agreement is clear, the next call is to an attorney, not a consultant. A demand letter, a suspension notice, a termination and anything that touches a client’s systems is legal work.

An outside review earns its fee when the late client is one leak among several: seats added and never billed, time never invoiced, licenses no client invoice carries, invoices aging past 60 days with no one assigned. The Revenue Review counts these under the Invoice → Payment hand-off and the ones around it. From read-only exports of the PSA, the distributor bills and the books, under an NDA signed first, it lists every invoice past terms with the clause that governs it, the late charges never billed, and the annual licenses held by clients who are behind. It touches nothing in client environments, never contacts a client and gives no legal advice. It takes two weeks and ends in a written report the firm keeps.

The next step is a free 20-minute call, where we say whether the Review is worth it, including when one late client and an hour with an attorney is the whole answer.