The Complete MSP Onboarding Checklist: Automate Client Setup

MSP onboarding is everything between a signed managed services agreement and the day your services go live. You audit the client's environment, agree scope and SLAs, deploy your RMM, backup and security tools, document the environment, and hand the client to your help desk. NinjaOne puts it at 40 to 80 hours per new client.

That is one to two working weeks per account, and most of it repeats from client to client: copying details between systems, chasing missing admin credentials, and setting up the same agents and policies you set up for the last client. This checklist splits the work into three phases and marks the steps worth templating or automating, so your techs spend their hours on the parts that need judgment.

What MSP client onboarding covers and why it matters

Client onboarding starts when the agreement is signed and ends when the client is live and your help desk can support them without calling the project lead. Rewst splits it into two jobs: onboarding the client (account owner, SLAs, audits, RMM, documentation, backup) and onboarding the client's users (Microsoft 365 accounts, licenses, groups, devices). Both belong on your checklist, because the user side keeps going long after go-live.

The first weeks also decide whether the client stays. Research from JumpCloud cited by Guardz found that 23% of SMEs that left an MSP did so because of poor service experiences. Onboarding is when a client first sees how you respond, communicate and document, so it is where that opinion forms. A client that is onboarded properly raises fewer emergency tickets and trusts your recommendations sooner, because you already know their environment.

The typical MSP onboarding process takes 4 to 6 weeks from contract signing to full implementation. Smaller organizations might finish in 2 to 3 weeks, and complex enterprise deployments with several locations or compliance requirements can stretch to 8 to 12 weeks.

Phase 1: MSP onboarding discovery, scope and kickoff

Discovery is where you gather what you need for everything that follows. Treating it as an ad-hoc conversation is a mistake, because every question you forget to ask now becomes a fire drill in week three.

Assign an owner and confirm scope

Before anyone touches a tenant, endpoint or firewall, re-read the managed services agreement with the person who will own the account. Hornetsecurity puts this step first because problems start when the client asks for something like backup cleanup or out-of-hours support that they think is included and your team thinks is extra. Name one project manager or account owner the client can go to with questions for the whole onboarding.

Send the MSP onboarding questionnaire

Use a standardized form so every client answers the same questions. Typeform, Google Forms or your PSA's built-in forms can sync the answers straight to the client record. Between them, the NinjaOne and Hornetsecurity checklists cover these fields:

• Company details, locations and working hours for each location
• Points of contact, and who can approve changes
• Users, roles and access permissions
• Servers, workstations, and any computers that must not restart during working hours
• Licensing, applications and third-party vendors
• Hardware warranties and leases with expiry dates, plus the ISP account
• Current security tools, backups, compliance requirements and existing issues

Hornetsecurity also suggests asking what the previous provider did that was never documented. Keep the form thorough enough to avoid a second round of questions, and short enough that the client actually finishes it.

Collect admin access early

Hornetsecurity lists not having enough administrative access and not documenting vendors among the most common problems once a project starts. Collect delegated admin for Microsoft 365, firewall and switch credentials, and vendor portal logins in the first week, before a tech needs them mid-task and the project stalls waiting on the client.

Run the asset inventory and network audit

You need to know what you're working with before you can price and plan correctly. Network monitoring tools like Domotz automatically discover and document every device on the network, which gives you an inventory that doesn't rely on the client's (often incomplete) knowledge. Domotz now also runs an MCP server so AI agents can work with the same network data your techs see. Pricing starts at €35 per collector per month (see the Domotz pricing breakdown), and in a Domotz case study, CIO Solutions reports saving 4 hours per site on onboarding and troubleshooting.

This audit is the basis for your pricing, your SLA and your first project roadmap.

Run the security risk assessment

According to Help Net Security, 35.5% of all breaches in 2024 were third-party related. During onboarding, review access permissions, find stale accounts from former employees, check privileged access and assess the current security tooling. NinjaOne now treats MFA checks, patch validation and vulnerability scans as standard onboarding steps, so run all three before you accept responsibility for the environment.

Ask specific questions. Do third parties have admin access to cloud storage? How are user identities created and deactivated? Is MFA enabled for every account? If you want a tool to do the first pass, compare the cyber risk audit tools for MSPs.

Write the SLA and onboarding plan

Based on discovery, document exactly what services you'll provide, response time commitments, escalation paths, and what is out of scope. Attach an onboarding plan with dates so the client knows when each phase lands. The SLA is the formal agreement that stops scope creep and sets realistic expectations on both sides.

Send a welcome kit and run the kickoff meeting

Guardz recommends a welcome kit with a service summary, SLAs, contacts, timelines and communication protocols, because misunderstandings about those are what push clients away early. Then hold the kickoff. Introduce the team who will work with the client, confirm roles and who approves what, and walk through the plan. Use the 80/20 rule: spend 80% of the time listening to their goals and 20% addressing concerns. Clear communication protocols agreed here save weeks of confusion later.

Most of this phase can be templated. The questionnaire, the access request, the risk assessment and the welcome kit can all follow a repeatable framework, and network discovery runs on its own. The more you standardize here, the faster and more consistent your onboarding becomes.

Phase 2: Technical implementation

This is where most MSPs lose time. The setup involves repetitive tasks across several systems, and every manual step is a chance for an error or a delay.

Set up the client in your PSA

Create the company record, configure billing, set up boards and statuses, and establish the communication workflows for the ongoing relationship. Document the client in your PSA so any technician can pick up a ticket and understand the environment. If you are still choosing a platform, see the best PSA software for MSPs.

Deploy RMM agents

RMM agent deployment means installing monitoring agents on every server, workstation and mobile device, then configuring monitoring policies, alert thresholds and maintenance schedules. Apply your patch management policy at the same time so the first patch cycle runs on your terms.

Implement and test backup

Deploy backup agents, configure schedules and run a test restore. Never mark a client as onboarded without verified backup coverage.

Deploy the security stack

Enforce multi-factor authentication across all systems. Deploy endpoint protection, configure firewall rules and review existing security policies. Change default credentials on every network appliance, and document each security configuration for compliance and future reference.

Migrate data with a test run first

Guardz advises testing migrations with dummy datasets to validate workflows, permissions and integrations before the live move. A misconfigured migration can expose data to the wrong people, so the test run is cheaper than the cleanup.

Document everything in IT Glue or Hudu

Record network topology, system configurations, user accounts, vendor contacts and standard operating procedures. Good documentation is what separates professional MSPs from break-fix shops. The IT Glue vs Hudu comparison covers which one fits your shop, and the MSP documentation guide covers what to record.

Secure passwords and credentials

Collect and store all administrative passwords, rotate them where necessary, and document password policies. When you need to pass a credential to the client, use a one-time secret sharing tool instead of email.

This phase is where automation saves the most. User account creation across M365 and Active Directory can be scripted, security configurations can be applied through group policy, and documentation templates can fill in from discovered data. Every hour you put into automation here saves hours on each future onboarding.

Once the client is live, every new hire they add becomes a new starter ticket. The Rallied new user onboarding checklist lists each step of that ticket, from approval to closeout, and the employee offboarding SOP covers leavers. Both copy straight into your PSA. For the automation side of that work, read how MSPs automate user onboarding.

Phase 3: Go-live and handoff to your help desk

The last phase moves the client from project to ongoing service and sets the communication rhythm you'll keep for the rest of the contract.

Test before you declare go-live

Verify that all systems work, monitoring is reporting, backups are running and security tools are protecting endpoints. ConnectWise recommends running diagnostics and security scans at this stage. Raise test tickets to confirm requests route to the right board.

Brief your help desk

Hornetsecurity points out that onboarding also has to prepare your own team to support the client once it is live. Before handoff, brief your techs on where the client's documentation lives, who the points of contact are, and which machines must not restart during working hours.

Train end users

Schedule training on new systems, security awareness and how to request support. Tailor it to different user roles, and leave documentation users can come back to.

Book the 30-day check-in

Plan a structured check-in for the first month to catch issues early. Once the account settles, move to regular monthly and quarterly reviews.

Set the QBR cadence

Agree the QBR schedule up front so the client knows what to expect. These reviews are where you show value, discuss improvements and align IT strategy with business goals, which is the core of vCIO services.

MSP client onboarding checklist

Copy this into your PSA as a project template and adjust it per client.

Discovery and kickoff:

• Account owner assigned and agreement reviewed
• Questionnaire returned and synced to the client record
• Admin access collected for M365, network devices and vendor portals
• Network discovery and asset inventory complete
• Risk assessment done, including MFA, patch status and stale accounts
• SLA, exclusions and onboarding plan signed off
• Welcome kit sent and kickoff held

Implementation:

• PSA company, contacts, billing and boards configured
• RMM agents on every device, with alert thresholds set
• Backups running and a test restore completed
• MFA enforced, endpoint protection deployed, default credentials changed
• Data migration tested on a dummy dataset before the live run
• Documentation and credentials stored in IT Glue or Hudu

Go-live:

• Monitoring, backup and security alerts reaching your techs
• Test tickets routed correctly
• Help desk briefed
• End-user training delivered
• 30-day check-in and first QBR booked

Common MSP onboarding mistakes and how to avoid them

Experienced MSPs make these mistakes too:

• Starting without a complete asset inventory. If you don't know what you're managing, you can't manage it, so use automated discovery rather than client-provided lists.
• Waiting on admin access. A project that stalls for a firewall password in week two loses the client's confidence, so collect access before implementation starts.
• Leaving vendors undocumented. The ISP, the line of business app vendor and the copier company all turn into tickets eventually.
• Inconsistent Microsoft 365 settings across tenants, which Hornetsecurity names as a common post-start problem. Apply one baseline to every new tenant.
• Poor documentation handoffs. When documentation lives in someone's head or in personal notes, you're exposed the day that person is out.
• Skipping the security baseline. Finding security gaps after you're responsible for the environment is far worse than finding them before you sign off.
• Not setting expectations up front. Scope creep kills profitability, so be explicit about what's included, what's extra and how changes are handled.

How AI is changing MSP onboarding

Most of those 40 to 80 hours go on steps that run the same way every time, which is why AI is being applied to them first. NinjaOne says AI and RMM integrations can cut MSP onboarding hours by up to 40%, though that is a vendor's own figure. Network tools are adding agent interfaces too, as with the Domotz MCP server mentioned above.

The practical uses today are narrower than the marketing. AI can create user accounts across M365 and Active Directory from a single request, draft documentation from network scan output, route tickets during the transition so nothing sits unassigned, and handle the password reset tickets that pile up in the first weeks of a new engagement. The judgment work in phase 1, such as scoping, pricing and the kickoff, still belongs to your team.

Rallied is an AI agent that closes tickets in your PSA (ConnectWise, HaloPSA or Autotask). Instead of suggesting next steps, it runs the fix in Microsoft 365 and your RMM, writes the notes and time entry back to the ticket, and pulls the client's documentation from IT Glue or Hudu during triage. For onboarding, that covers the new starter tickets and access requests that arrive once the client is live, so your team can stay on client relationships, complex configurations and security architecture. Rallied is one plan at $300 a month with 2,000 credits included, and a ticket it couldn't finish or wasn't allowed to act on is never charged.

Building your MSP onboarding playbook

A checklist you use once is a document. A playbook is a checklist you improve after every client. The advice on r/msp is to start with a universal checklist, customize it for each client, and keep it updated.

Take notes as you go: which questions clients struggle with, which technical steps take longest, and where errors usually happen. Feed that back into your templates and automation.

Build templates for common client types, because a 10-person professional services firm needs a different plan from a 200-person manufacturer. A standard playbook for each segment saves you rebuilding the plan every time.

Build automation workflows for the repetitive tasks, starting with the highest-volume, lowest-complexity ones, since each manual step you remove saves time and cuts errors on every future client.

Measure onboarding time, client satisfaction scores and early ticket volume, then use those numbers to find the bottlenecks.

MSPs that get onboarding right lose fewer clients, and prospects comparing providers notice when your process is clear from the first call. To choose tools for the automated steps, read 7 Best MSP Automation Tools in 2026.

Frequently Asked Questions

How long should MSP onboarding take?

The typical MSP onboarding process takes 4 to 6 weeks from contract signing to full implementation. Smaller organizations with simple environments might finish in 2 to 3 weeks, while larger clients with several locations or compliance requirements can take 8 to 12 weeks. NinjaOne puts the effort at 40 to 80 hours per new client, and how much of that you automate affects the timeline.

What should be included in an MSP client onboarding checklist?

Cover three phases. Discovery and kickoff covers the account owner, questionnaire, admin access, asset inventory, risk assessment, SLA and welcome kit. Implementation covers PSA setup, RMM deployment, backup with a test restore, the security stack, a tested data migration and documentation. Go-live covers testing, the help desk briefing, user training, the 30-day check-in and the QBR schedule.

What should an MSP onboarding questionnaire ask?

Ask for company details, locations and working hours, points of contact, users and their access permissions, and servers and workstations, including any machines that must not restart during working hours. Also collect licensing, applications, third-party vendors, warranties and leases, the ISP account, current security tools, backups and compliance requirements. Ask what the previous provider did that was never documented.

What is the difference between client onboarding and user onboarding?

Client onboarding brings a new company into your managed services: scope, SLAs, audits, RMM, backup and documentation. User onboarding sets up that client's individual people, such as Microsoft 365 accounts, licenses, groups and devices. Client onboarding ends at go-live, and user onboarding continues for as long as the client keeps hiring.

Why do MSPs need a structured onboarding process?

A structured process prevents security gaps, reduces downtime during the transition and sets clear expectations on scope. Research from JumpCloud cited by Guardz found that 23% of SMEs that left an MSP did so because of poor service experiences, and onboarding is where clients first judge your service. A repeatable checklist also makes the 40 to 80 hours per client easier to template and automate.

How can AI improve the MSP onboarding process?

AI can create user accounts across M365 and Active Directory, draft documentation from network scans, route tickets during the transition and handle password resets. NinjaOne says AI and RMM integrations can cut onboarding hours by up to 40%, though that is a vendor figure. Scoping, pricing and the kickoff still need your team's judgment.

What are the most common MSP onboarding mistakes?

The most common mistakes are starting without a complete asset inventory, waiting on admin access, leaving vendors undocumented, inconsistent Microsoft 365 settings, poor documentation handoffs, skipping the security baseline and not setting expectations up front. Most of them lead to scope creep, security gaps or a stalled project that damages the relationship early.