If onboarding doesn’t end with a written list of findings, it was just a sign-up

What the first 90 days should produce

When you sign with a new managed IT provider, the first 90 days should produce four things you can hold in your hand: an inventory of every device, account and system you have; a cleaned-up list of who has admin rights; proof that your backups actually restore; and a written list of what they found, ranked by risk, with what they have fixed and what is still open. If you reach day 90 without that last document, you have not been onboarded. You have been signed up.

That is my firm view after running JLB for more than 15 years. Providers rarely fail by doing nothing. The usual failure is a busy one: lots of useful-sounding activity (agents installed, tickets closed, a welcome call) and never a written account of the state of your systems on the day they took over. Without that baseline, nobody can tell later whether things got better.

This is the checklist I would hold any new provider to, us included. Use it whether you are switching providers or hiring your first one.

Before day one

A good onboarding starts before the contract’s start date, with the handover. Ask your old provider, or your internal IT person, for the admin credentials, domain registrar login, firewall access, software license details, backup console access and any documentation they kept. If the old provider is unhelpful, your contract with them may say what they owe you on exit. Our article on managed services agreements covers the clauses worth checking.

Also agree on who at your company is the main contact, who can approve changes, and how staff will reach the new help desk from the first morning.

Days 1 to 30: find out what you have

1. Install monitoring and management tools on every computer and server, and reconcile the count against your own list of staff and devices. Gaps are common, and they matter.
2. Build the inventory: computers (age, warranty, operating system), servers, network equipment, printers, phones, and every cloud service the business pays for.
3. List every admin account in Microsoft 365 or Google Workspace, the firewall, the domain registrar, DNS, the backup system and line-of-business software. Note who each belongs to.
4. Check MFA status for every user and every admin account. Write down the exceptions.
5. Confirm who owns the domain name and that the registrar account is in the company’s name, not a former employee’s or the old provider’s.
6. Look at the backups: what is backed up, where, how often, and whether anyone has ever done a restore.
7. Check update status on computers, servers and network devices. Windows 10 reached end of support on October 14, 2025, so any machine still running it should be on the list.
8. Collect vendor contacts and contract renewal dates for internet, phones, copiers and software.

Days 31 to 60: fix the dangerous things

1. Remove admin rights that are not needed. Microsoft’s own guidance is to have as few Global Administrators as possible and to assign the least permissive role that does the job.
2. Set up separate admin accounts for the people who need them, so nobody reads email with global admin rights.
3. Create break-glass emergency access accounts, as Microsoft recommends, stored securely, so you are never locked out of your own tenant.
4. Close the MFA gaps, including the ones for senior people.
5. Do a real test restore: pick a folder and a mailbox, restore them, and time it. Write down the result.
6. Disable accounts for people who have left, and remove shared logins where you can.
7. Put endpoint protection and patching on a schedule, with a report you can see.

If you would like an independent view of where your systems stand, before or after you switch, our free Technology Health Assessment does that in 30 minutes of data collection, with a plain-language report the next day. The report is yours to keep, no obligation. Book your free assessment.

Days 61 to 90: write it down and plan

1. Deliver the findings report: what they found, ranked by risk, what has been fixed, what is open, and what each open item would take.
2. Give you access to the documentation: network diagram, inventory, admin account list, backup schedule, vendor list. You should be able to read it without asking.
3. Agree a replacement plan for aging computers and anything out of support, with a budget.
4. Write or update the recovery plan: who does what if the server, the internet line or Microsoft 365 goes down.
5. Set the rhythm from here on: a regular review meeting, the reports you will get, and how often backups are test-restored.

Red flags during onboarding

Some things should make you ask questions early. A provider that asks for your passwords by email. One that keeps the documentation on its own systems and won’t give you a copy. One that never asks who owns the domain. One that can’t tell you, by day 30, how many computers you have. And one whose first big recommendation is a hardware purchase, before it has finished the inventory.

The quieter red flag is the absence of a findings report. If you ask for it and get a dashboard login instead, ask again. A dashboard shows the present. A findings report shows what was wrong when they arrived, which is how you hold them to account later.

For a list of what a broader IT review should cover, see our IT assessment checklist.

If you have an IT person already

Onboarding goes faster, not slower, when there is someone inside who knows the systems. A good provider treats that person as an ally and splits the work clearly: who handles the help desk, who owns the network, who signs off on changes. We do this regularly in co-managed IT arrangements. Through our managed IT service for businesses of roughly 25 to 100 people, onboarding ends with the written findings, because, as I said at the start, without it you have only signed up.

Related services

• Managed IT services
• Free Technology Health Assessment
• Managed services agreements
• Co-managed IT services