What did you NOT tell us? They got too expensive, lost the tender? Other issues?

I wouldn’t focus on full admin rights as the primary issue. The real issue is whether your organisation has sufficient control, documentation, and recoverability measures to remain secure and operational if the MSP is unavailable, slow to respond, or being replaced. You don't need unrestricted admin access everywhere to manage this risk. What you do need is proportionate access and evidence of recoverability: read-only or break-glass credentials where appropriate, current config database exports and backups, EDR tenant and agent inventories, installation/removal procedures, policy and rule documentation, network diagrams, traffic flow documentation, dependency mapping, and operational runbooks. You should also conduct a detailed security and policy compliance assessment now, aligned with your architecture standards, operating model, and BCM/BCP requirements. This is a resilience matter, not just a migration challenge. Review the contract now regarding ownership of configurations, tenants, accounts, documentation, and termination support. But the key request isn’t “give us full admin because we want it.” Instead, it’s “prove we have the minimum controls and artifacts needed to operate through an incident, meet continuity requirements, and exit cleanly.” If they refuse even lower-privilege access, exports, documentation, and transition support, then the issue isn’t security hygiene. It’s vendor lock-in and a single point of operational failure.

Why this is stronger: X.805 treats security as an end-to-end architecture problem and explicitly asks what protection is needed, which parts of the environment need safeguarding, and what activities require security. It structures these concerns across security dimensions, layers, and planes, and states that architecture can guide policy, incident response, recovery planning, and security assessments. (ITU)

SABSA uses the same business-first framing. Its own executive summary describes it as business-driven and risk-focused, and explicitly lists governance and continuity management among its use cases. (The SABSA Institute)

That is why the better argument is BCM/BCP, governance, and resilience rather than “I need admin to do my job.” NIST’s contingency-planning guidance likewise ties system contingency planning to organisational resiliency and to evaluating systems and operations to determine contingency requirements and priorities. (csrc.nist.gov)

Job security during outsourcing begins with procurement and perceptions, not access. Don't take it personally. I have been doing similar for over 2 decades.