MSP Onboarding Checklist: The 30-Day Playbook

MSPs spend 40 to 80 hours onboarding a single new client, and the ones who wing it pay for it later. The first 90 days is when a client is most likely to churn, so a sloppy start does not just cost you tech hours. It costs you the account.

Service businesses lose $50,000 to $120,000 a year (according to OnboardMap) on avoidable onboarding friction: wasted staff time, delayed migrations, scope creep, early churn, and the referrals you never get.

The fix is boring, but it works. A repeatable checklist that runs the same way for every client, so nothing depends on which tech happened to pick up the kickoff. This is that checklist, broken into six phases across the first 30 days, with owners and outputs for each step. Copy it, adapt the naming to your stack, and run it the same way every time.

Prefer a one-pager? Download the full MSP onboarding checklist as a printable PDF and hand it to your team or drop it into your PSA.

What MSP Onboarding Covers

Onboarding is the handoff from "signed contract" to "we fully manage this environment." It is not the sales process and it is not day-two support. It is the window where you take custody of a client's infrastructure, document it, secure it, and prove you can operate it without breaking anything.

The scope is wider than most checklists admit. You are inventorying assets, deploying agents, rebuilding security baselines, migrating from whatever the last provider left behind, and setting expectations with people who have been burned before. Get the sequence wrong and you either flood the client with agent installs before you understand their network, or you sit on a discovery call for three weeks while their tickets pile up in your inbox with no monitoring in place.

Two numbers should shape how you run this. First, that 40-to-80-hour cost per client means onboarding is one of the most expensive things your team does, so every hour you cut without cutting quality goes straight to margin. Second, churn concentrates in the first 90 days, so the point of the checklist is not tidiness. It is retention.

There is a third reason to systematize it that rarely makes the sales deck. A client watches how you onboard and decides right then whether they trust you with their business. A smooth, communicative first month buys you patience for the inevitable rough ticket six months later. A chaotic one means every future mistake gets read as proof they picked wrong.

Phase 1: Discovery and Client Intake (Days 1 to 3)

Before a single agent touches a machine, you gather. The goal of the first three days is a complete picture of what you just agreed to manage, because the quote a salesperson wrote and the reality on the ground are rarely the same thing.

Send a structured intake questionnaire the day the contract is signed. You want primary and after-hours contacts, a list of critical applications and who owns them, line-of-business software and its vendors, compliance obligations, existing licenses, and the name and contact of the outgoing IT provider. That last one matters more than people think. The handoff from the previous MSP is where credentials go missing and where a hostile provider can leave you locked out of a domain admin account you need on day four.

The deliverable at the end of Phase 1 is a client profile that any tech on your team could read and understand the environment cold. If a step depends on knowledge that lives only in one person's head, the onboarding is already fragile.

Phase 2: Network and Security Assessment (Days 3 to 7)

Now you look at what is really there. A network assessment during onboarding is not the same soft scan you ran during the sales cycle. This one is exhaustive, because everything you document here becomes the baseline you get measured against.

Walk the physical and logical layout: firewalls and their rule sets, switches, wireless, VPN configs, the server inventory, workstation count and age, the domain structure, and every SaaS tenant the client depends on. Map dependencies while you are in there. The line-of-business app that nobody mentioned but that quietly runs the whole billing department is exactly the thing that breaks at 2 a.m. three weeks in.

Flag risk as you go. Unsupported operating systems, firewalls running default credentials, backups that have not completed successfully in months, local admin rights handed out like candy. You are not fixing yet. You are building the punch list that Phase 5 works through, and you are giving the client an honest read on the state of their environment before you own the consequences of it.

Set expectations here too. If the assessment turns up problems that fall outside the signed scope, say so in writing before you touch them, or you have just volunteered for a remediation project nobody is paying for. Scope creep in the first two weeks is one of the fastest ways an onboarding goes underwater. Document findings in whatever will become your permanent record, because a good assessment is worthless if it lives in a spreadsheet nobody opens again. Solid IT documentation for MSPs turns this one-time assessment into an asset your whole team uses for years.

Phase 3: Documentation and the Single Source of Truth

Documentation is not a phase you do once and file away. It runs alongside everything, but the first 30 days is when you set the standard that every future ticket inherits. The MSPs who scale cleanly are the ones who decided early what "documented" means and enforced it.

Set naming conventions before you create a single record. Device names, ticket categories, asset tags, and password entries all need a consistent format, because the moment two techs invent their own scheme you have a search problem that compounds forever. A client's record should hold the network diagram, IP schema, domain and DNS details, critical application list, backup configuration, vendor contacts and account numbers, and the SLA terms you committed to.

Store credentials in a real password manager with role-based access, not a shared vault everyone can see. Least privilege applies to your own team, not just the client's users. When you offboard a tech later, you want to rotate a scoped set of credentials, not every password you hold for that account. The discipline you set here is the difference between an environment a new hire can pick up in a day and one that takes a month of tribal knowledge to understand.

Phase 4: Tooling, RMM, and Access Provisioning (Days 7 to 14)

With the environment mapped and documented, you deploy. This is the phase most checklists start with, and that is the mistake. Pushing agents before you understand the network is how you end up troubleshooting a monitoring alert storm instead of managing a client.

Roll out your RMM agents to servers, workstations, and mobile devices in a controlled wave, not all at once. Confirm each endpoint checks in, reports accurate inventory, and accepts patches before you move to the next batch. Connect the client into your PSA so ticketing, billing, and time tracking are live from day one. Set up monitoring thresholds and alerting so you are watching the environment before you promise to. Provision your team's admin access using scoped accounts, and provision the client's users into whatever identity and access structure you standardize on.

Data and email migrations often live in this phase, and they are where timelines slip. Moving a client off an old email tenant, cutting over file shares, or migrating from a previous RMM means coordinating downtime with a business that has real deadlines. Sequence migrations after monitoring is live, never before, so you can see what breaks the moment it breaks. Give the client a written cutover schedule and a rollback plan for each migration, because the one time you skip the rollback plan is the time you need it.

The tooling sprawl problem shows up right here. A typical MSP is stitching together an RMM, a separate PSA, a documentation tool, a password manager, a monitoring platform, and a remote access tool, each with its own agent, its own login, and its own onboarding steps to repeat per client. Every disconnected tool is another thing to deploy, another integration to babysit, and another vendor invoice. The fewer platforms a new client has to be provisioned into, the faster and cheaper this phase gets.

Phase 5: Security Baseline and Hardening

This is where you work the punch list from Phase 2 and bring the client up to a security standard you can defend. Skipping it is how MSPs end up explaining a breach that started on an endpoint they onboarded but never hardened.

Enforce multi-factor authentication across every account that supports it, starting with admin and email. Deploy endpoint protection or EDR and confirm it is reporting to your console, not sitting in a default install nobody checks. Verify backups actually restore, because a backup you have never tested is a hope, not a recovery plan. Establish a patch baseline and get every machine current. Remove standing local admin rights and move to least privilege. Decommission the access the outgoing provider still holds, since a former MSP with lingering domain credentials is a supply chain risk sitting inside your new client.

Build the baseline once, as a repeatable standard, and every client inherits the same floor. If you want a full picture of the layers that belong in that standard, this breakdown of the MSP security stack covers what nobody warns you about. Security is not a phase you finish. It is the state you keep the environment in, and onboarding is where you set the bar.

Phase 6: Go-Live, Kickoff, and the First 30 Days

The technical work means nothing to the client if they do not know how to reach you. Go-live is as much communication as configuration.

Run a formal kickoff with the client's stakeholders. Walk them through how to open tickets, who their points of contact are, what your response times commit to, and what "managed" covers versus what falls outside scope. Hand over training materials for any new tools their team touches. Set the cadence for reporting and check-ins, because a client who hears from you only when something breaks is a client already shopping for your replacement.

Then hold the line for 30 days. Watch the monitoring closely, resolve the early tickets fast, and treat the first month as probation for the relationship, not the client's. This is the window where trust gets built or lost. A 30-60-90 structure keeps it honest: days 1 to 30 for discovery and stabilization, 31 to 60 for migrations and cleanup projects, 61 to 90 for optimization and the first real business review. Clients who feel managed in month one rarely leave in month six.

Where Onboarding Breaks

The failures repeat across every MSP that has not systematized this. Knowing them is half the fix.

• Deploying agents before discovery, so you drown in alerts from an environment you do not understand yet.
• Leaving the outgoing provider's access in place, which is both a security hole and a political landmine.
• Documenting in someone's head instead of a shared system, so the onboarding tech becomes a single point of failure.
• Treating security hardening as optional cleanup for "later," which never comes.
• Going quiet after go-live, which reads to a nervous new client as neglect.

Every one of these traces back to the same root cause. The onboarding ran on memory and heroics instead of a checklist. The teams that win here are not smarter. They just refuse to improvise the same process forty times a year.

Cutting the 40-to-80-Hour Onboarding Cost

The single biggest lever on onboarding cost is automation, and the second is consolidation. Modern tooling can cut onboarding time by 30 to 40% by handling the repetitive account creation, license assignment, group membership, and provisioning steps that eat a tech's afternoon. AI agents built for MSP work can pull a new-client record, create accounts, assign licenses, set permissions, and document the whole pass in one run, instead of a tech clicking through the same twelve screens per user.

Consolidation compounds the savings. Every tool you drop is one fewer platform to provision each client into. This is where an AI-native all-in-one MSP platform changes the math. OpenFrame folds RMM, native PSA, documentation, and monitoring into one system, so onboarding a client means provisioning them once, not stitching six vendors together per account. PSA is included, not a bolt-on you buy separately. The pitch is not that it is the fanciest option. It is affordable, there is no vendor lock-in, and one platform means one onboarding path your whole team runs the same way.

Run the numbers on a real onboarding. Say your blended tech cost is $65 an hour. A 70-hour onboarding costs you $4,550 in labor before the client pays a first invoice. Cut that by 35% with automation and consolidation and you save roughly $1,600 per client. Onboard 30 clients a year and that is close to $48,000 back in your pocket, or the difference between hiring a tech and not needing to. The checklist is what makes the automation safe; the automation is what makes the checklist cheap.

None of that replaces the checklist. Automation runs a bad process faster; it does not fix it. Build the repeatable sequence first, standardize your security baseline, document to one source of truth, then automate the steps that never needed a human. Do it in that order and the 40-to-80-hour client becomes a 25-hour client, and the 25-hour client becomes the reason your margins hold while the vendor tax keeps climbing for everyone else.

Onboarding is the first promise you make to a client. Run it like an afterthought and they will treat your contract the same way.