MSP Client Onboarding Checklist: 30-Day Playbook

Client onboarding is the most consequential 30 days in any MSP engagement. It sets the tone for the entire relationship, determines how efficiently you can support the client going forward, and directly impacts whether they become a long-term, profitable account or a constant source of escalations and frustration.

Yet most MSPs wing it. The owner or a senior tech does a quick network scan, deploys agents, dumps some passwords into a spreadsheet, and calls it done. Then six months later, the team is still discovering undocumented servers, missing backups, and security gaps that should have been caught on day one.

This guide is a structured 30-day playbook you can adapt to your MSP. It's organized into three phases: Discovery (days 1-7), Deployment (days 8-14), and Optimization (days 15-30). Every item has a clear purpose and a definition of done. A printable version of the checklist is at the end of this guide.

Onboarding also matters commercially. In Kaseya's 2026 survey of MSPs, 12% named onboarding as their biggest challenge in acquiring customers (Kaseya 2026 State of the MSP Report, Figure 3). For the wider picture on winning and keeping clients, see the MSP growth and sales hub our guide to growth strategies and how MSPs win clients without referrals.

Before Day 1: Pre-Onboarding

Onboarding actually starts before the contract is signed. During the sales process, you should have gathered enough information to scope the engagement. Once the contract is signed, there's a critical pre-onboarding phase.

Contract and administrative setup:

• Signed MSA and service agreement filed in your PSA
• Client created in your PSA with correct billing information
• Billing configured (first invoice scheduled or auto-billing set up)
• Client contact list obtained (primary contact, decision maker, billing contact, emergency contacts)
• Insurance certificate exchanged if required
• NDA executed if required by the client

Internal preparation:

• Onboarding project created in your PSA with all tasks and due dates
• Primary technician assigned as onboarding lead
• Account manager assigned (may be the same person in smaller MSPs)
• Client added to your documentation platform with folder structure created
• Kickoff meeting scheduled with client stakeholders

Client communication:

• Welcome email sent with: your support contact methods, help desk portal access, expected timeline for onboarding, what you'll need from them (admin credentials, physical access, vendor contacts)
• Kickoff meeting agenda shared in advance

Phase 1: Discovery (Days 1-7)

The first week is about understanding exactly what you're managing. You're auditing the environment, documenting what exists, identifying risks, and building the foundation for everything that follows.

Day 1-2: Kickoff and Access

Kickoff meeting (1-2 hours, on-site or video):

• Introduce the team members who'll be supporting the client
• Walk through the onboarding timeline and set expectations
• Confirm the scope of services (refer to the contract)
• Identify the client's top 3 technology pain points
• Discuss their business context: growth plans, seasonal peaks, compliance requirements
• Collect or confirm all administrative credentials
• Schedule the on-site audit (if not done same day)

Access acquisition:

• Domain admin credentials obtained and stored in password vault
• Firewall/router admin access confirmed
• Cloud admin access (Microsoft 365 Global Admin, Google Workspace Super Admin) confirmed
• Switch/AP management access confirmed
• Backup solution admin access confirmed
• Key vendor portal credentials (ISP, phone system, LOB applications) obtained
• Physical access arrangements confirmed (keys, alarm codes, after-hours access)
• VPN access configured for your team (or site-to-site VPN established)

Definition of done: You can remotely access the client's network, log into all critical systems, and reach all management interfaces without calling the client for credentials.

Day 3-5: Environment Audit

This is the most time-intensive part of onboarding. Send your best technician — the one who notices things that others miss.

Network audit:

• Network topology mapped (subnets, VLANs, inter-VLAN routing)
• All IP ranges scanned and devices inventoried
• Firewall rules reviewed and documented
• Open ports identified and assessed for risk
• VPN configurations documented
• Wireless networks mapped (SSIDs, security settings, guest isolation)
• ISP circuit details documented (provider, circuit ID, bandwidth, SLA, support number)
• Network performance baseline captured (bandwidth, latency, packet loss)
• Switch port mapping completed
• DNS configuration reviewed (internal and external)

Server audit:

• All physical and virtual servers inventoried
• OS versions and patch levels documented
• Hardware specs and warranty status recorded
• Disk space and performance baseline captured
• Installed roles and applications documented
• Backup configuration reviewed and tested (run a test restore)
• Antivirus/EDR status checked
• Domain controller health verified (replication, FSMO roles, DNS)
• Certificate inventory compiled (SSL, code signing, expiration dates)
• Service accounts documented

Workstation audit:

• Total workstation count confirmed
• OS versions and patch levels assessed
• Standard vs. non-standard configurations identified
• Hardware age and warranty status sampled (full inventory comes with RMM deployment)
• Local admin account status checked
• Disk encryption status (BitLocker/FileVault) verified
• Existing antivirus/EDR products identified (for removal and replacement)

Cloud audit:

• Microsoft 365 / Google Workspace license inventory
• User count and license assignment review
• MFA status for all users (especially admins)
• Conditional access policies reviewed (or noted as absent)
• Mail flow configuration documented (MX records, spam filtering, transport rules)
• SharePoint/OneDrive usage and sharing settings reviewed
• Third-party app integrations listed
• Admin accounts audited (who has Global Admin? Should they?)

Security assessment:

• Current security tools inventoried
• Password policy reviewed
• MFA adoption rate calculated
• Email security gateway configuration reviewed
• Web filtering configuration reviewed
• Endpoint protection coverage verified (any unprotected devices?)
• Security awareness training status checked
• Previous security incidents discussed with client
• Cyber insurance policy reviewed (coverage and requirements)

Definition of done: You have a complete, documented picture of the client's environment. No surprises. You know every device, every service, every credential, and every risk.

Day 5-7: Risk Assessment and Remediation Plan

Based on the audit, produce two deliverables:

1. Environment Assessment Report (for the client)

A professional document summarizing:

• Current state of their IT environment
• Critical risks identified (ranked by severity)
• Recommended immediate remediations
• 90-day technology roadmap
• Ongoing monitoring and maintenance plan

This report is client-facing. It should be clear, non-technical where possible, and demonstrate the value of your engagement. Many clients have never received anything like this from an IT provider, and it immediately differentiates you.

2. Internal Remediation Punch List (for your team)

A prioritized task list of everything that needs fixing:

• Critical (fix this week): Unpatched systems with known vulnerabilities, missing backups, admin accounts without MFA, open firewall ports, expired SSL certificates
• High (fix within 30 days): Non-standard configurations, outdated firmware, incomplete monitoring coverage, missing documentation
• Medium (fix within 90 days): Hardware approaching end of life, sub-optimal configurations, nice-to-have security improvements
• Low (QBR discussion): Long-term recommendations, hardware refresh planning, future cloud migration opportunities

Definition of done: Client has received and acknowledged the assessment report. Your team has a prioritized punch list with owners and due dates.

Phase 2: Deployment (Days 8-14)

Now you deploy your tools and start bringing the client into your management ecosystem.

Day 8-10: Tool Deployment

RMM agent deployment:

• Agents installed on all workstations and servers
• Devices organized into correct groups/sites in your RMM
• Monitoring policies applied (CPU, memory, disk, service status)
• Patch management policies configured
• Maintenance windows defined (when can you patch and reboot?)
• Automated scripts deployed (disk cleanup, temp file removal, routine maintenance)
• Verify all agents are checking in and reporting correctly

Security tool deployment:

• EDR/antivirus deployed to all endpoints (remove existing products first to avoid conflicts)
• Email security gateway configured (SPF, DKIM, DMARC verified)
• DNS filtering deployed
• Web content filtering policies applied
• MFA enforced for all users (coordinate rollout with client to avoid lockouts)
• Security awareness training platform configured and first campaign scheduled

Backup deployment:

• Backup agents installed on all protected systems
• Backup schedules configured (align with client's RPO requirements)
• Retention policies set
• Offsite/cloud backup replication confirmed
• First full backup completed successfully
• Test restore performed and documented

PSA configuration:

• Client site and contacts created in PSA
• SLA configuration applied
• Automated ticket routing rules created
• Client portal access configured and tested
• Recurring maintenance tasks scheduled (backup verification, patch review, security review)

Definition of done: All your tools are deployed, reporting, and functioning correctly. You can monitor every device, protect every endpoint, back up every critical system, and receive tickets from every user.

Day 11-12: Documentation Completion

With tools deployed and the audit complete, finalize your documentation. This is the part most MSPs skip, and it's the part that pays dividends for years.

Complete in your documentation platform:

• Network diagram (logical topology with IP addressing)
• All server documentation (specs, roles, applications, dependencies)
• All credentials stored in password vault with appropriate access controls
• Cloud service configuration documentation
• Backup configuration and recovery procedures
• Client-specific SOPs (any processes unique to this client)
• Vendor contact directory (ISP, phone vendor, LOB application vendors, printer vendor)
• Escalation path for this client (who to contact for approvals, after-hours, emergencies)

For a deep dive on documentation standards, see our guide on MSP documentation best practices.

Definition of done: A new technician unfamiliar with this client could open your documentation platform and have everything they need to support the environment effectively.

Day 13-14: User Communication and Training

This step is about the end users — the actual people who will be calling your help desk.

User welcome communication:

• Email to all users introducing your company as their new IT provider
• Help desk contact methods (phone, email, portal) with clear instructions
• What to contact you for (and what to contact their internal team for, if co-managed)
• Expected response times by priority
• How to submit a ticket
• Emergency contact procedure for after-hours critical issues

End-user training session (30-60 minutes, all-hands):

• How to reach the help desk and submit tickets
• Security awareness basics (phishing, password hygiene, MFA usage)
• Any new tools they'll interact with (password manager, MFA app, web filtering)
• Q&A — let users ask questions. Their questions reveal pain points you haven't uncovered yet.

Definition of done: Every user knows who you are, how to reach you, and what to expect. No user should encounter your help desk for the first time during a crisis.

Phase 3: Optimization (Days 15-30)

The environment is documented, tools are deployed, and users know how to reach you. Now you optimize.

Day 15-21: Remediation Sprint

Work through the critical and high-priority items from your remediation punch list:

• Patch all systems to current levels
• Remediate critical vulnerabilities identified in the audit
• Fix backup gaps (systems that should be backed up but aren't)
• Close unnecessary firewall ports
• Enforce MFA on all remaining accounts
• Remove unauthorized software
• Standardize configurations where feasible
• Resolve any tool deployment issues (agents not reporting, policies not applying)

Track every remediation as a ticket in your PSA. This creates an audit trail and lets you report to the client on what you've fixed.

Day 22-25: Stabilization and Tuning

After two weeks of active management, you have data. Use it.

Alert tuning:

• Review all alerts generated in the first two weeks
• Suppress false positives and noisy alerts
• Adjust thresholds that are too sensitive or not sensitive enough
• Confirm critical alerts are being routed and escalated correctly

Ticket analysis:

• Review all tickets from the first two weeks
• Identify patterns (same issue recurring? Same user struggling?)
• Create runbooks for any client-specific recurring issues
• Adjust SLA configurations if needed

Performance baseline:

• Capture post-deployment performance metrics
• Compare to pre-deployment baselines from the audit
• Document improvements (faster boot times, reduced downtime, resolved chronic issues)

Day 26-28: Internal Review

Before presenting to the client, conduct an internal review:

• Is all documentation complete and accurate?
• Are all tools deployed and functioning?
• Have all critical remediations been completed?
• Are there any outstanding risks the client needs to know about?
• What's the 90-day plan for this client?
• Is the client profitable at the contracted rate? (Check actual time spent against budget)

Day 29-30: 30-Day Review Meeting

Schedule a formal review meeting with the client's decision maker and primary contact.

Agenda:

1. Summary of what was accomplished — tools deployed, issues discovered and resolved, security improvements made
2. Metrics — ticket volume, response times, systems now monitored, backup success rates
3. Outstanding items — what's still in progress, what's planned for the next 60 days
4. 90-day roadmap — technology recommendations, planned improvements, upcoming projects
5. Feedback — how has the experience been? What can you improve?
6. Confirmation — confirm the client is satisfied and the transition from onboarding to steady-state support is complete

Definition of done: Client confirms satisfaction with the onboarding process. Steady-state support begins. First QBR scheduled for 90 days out.

The Onboarding Checklist: Quick Reference

Here's the condensed checklist you can print or copy into your PSA as a project template:

Common Onboarding Mistakes

Rushing it. Thirty days is not arbitrary. If you try to compress onboarding into a week, you'll miss things. Those missed things become emergencies three months later.

Not charging for it. Onboarding is real work that consumes real resources. Charge an onboarding fee. Frame it as a "Technology Assessment and Transition" service. Fee ranges quoted elsewhere are illustrative and rarely sourced, so price it from the hours your last few onboardings actually took, plus a margin. See how to price MSP services for the method.

Skipping the user training. End users who don't know how to reach you will either suffer in silence or call their "old IT guy." Neither outcome is good for you.

Not documenting as you go. If you do the audit but don't document until later, you'll forget details. Document in real-time during the audit, not after.

Ignoring the political landscape. Every new MSP engagement displaces someone — an internal IT person, a previous MSP, or the owner's nephew who "does the computers." Be aware of who might be resistant to the transition and manage those relationships carefully.

For more on tracking the metrics that matter during and after onboarding, see our guide on MSP KPIs that matter. Documentation is the part of onboarding that pays off longest; our documentation guide includes an SOP template.

---

How strong is your onboarding process? Take the free MSP Readiness Assessment to evaluate your operational maturity across onboarding, documentation, service delivery, and more. A structured onboarding process is one of the strongest indicators of MSP readiness to scale.