Monthly IT Maintenance Checklist Template

What the Monthly IT Maintenance Checklist Covers

1. 1
   Phase 1

   Phase 1: Scope & Endpoints

   6 tasks

   Two answers on the first task, MSP client and servers, decide what appears in Phases 2 and 7.

   • Open the run and record the estate, the month and the approver — whether it is an MSP client, whether it has servers, and who signs off the month
   • Record endpoint patch compliance from the signed-off patch cycle report — take the figure from the cycle, do not estimate it; the patching runs in its own checklist
   • Check endpoint protection coverage — every device reporting to the console, definitions current and no detection left unresolved
   • Check disk encryption on laptops and desktops — list devices without BitLocker or FileVault, and any whose recovery key is not escrowed
   • Review devices that are non-compliant in device management — why each fails policy, and whether conditional access is already blocking it
   • List devices on an operating system version near or past end of support — each one gets an upgrade, a replacement date or a recorded exception
2. 2
   Phase 2

   Phase 2: Servers & Backups

   5 tasks

   The first task appears only when the estate has servers. The rest runs everywhere: cloud-only estates still have data to protect.

   • Confirm this month’s server maintenance runs were completed — one per server group, with every finding ticketed
   • Review patch exceptions that expire this month — renewed with fresh approval or escalated; carry any overdue exception into the report
   • Check the month’s backup job results across every protected system — servers, Microsoft 365 or Google Workspace data and endpoints; note the last good backup for each failure
   • Check backup coverage for everything added this month — new servers, shared mailboxes, SharePoint sites, Teams and SaaS workspaces are the usual gaps
   • Confirm the restore test due this period ran and passed — or is booked with a date; the test itself runs in the backup verification checklist
3. 3
   Phase 3

   Phase 3: Network & Firewall

   5 tasks

   • Compare firewall, switch, wireless and VPN firmware with vendor releases — schedule updates for critical and high-risk fixes through the change process
   • Confirm configuration backups ran for every network device — stored off the device, so a failed switch is rebuilt from its saved config
   • Review firewall rule changes made this month — each inbound rule has an approver and a written business need; rules for finished projects come out
   • Check that no management interface is open to the internet unprotected — firewall, VPN and wireless controller admin pages need MFA or an IP allow list
   • Review internet and site link availability for the month — outages, flapping VPN tunnels and links that ran near full at peak times
4. 4
   Phase 4

   Phase 4: Accounts & SaaS Tenant

   6 tasks

   • Reconcile this month’s leavers against enabled accounts — the directory plus every SaaS application that is not behind single sign-on
   • Check MFA coverage for every user — users not yet MFA-capable, and each exclusion from the MFA policy with an owner and an end date
   • Review who holds administrator roles — remove anyone who no longer needs a role, and keep Global Administrators to fewer than five
   • Check the emergency access accounts — any sign-in this month is explained, and the last validation test is within 90 days
   • Count accounts inactive for 45 days and hand them to the cleanup run — record the number here; disabling and deleting them happens in the account cleanup checklist
   • Read the tenant’s service health and message centre — act on any post with an act-by date, a retirement or a change that needs an admin
5. 5
   Phase 5

   Phase 5: Renewals, Expiry Dates & Records

   5 tasks

   • Check the expiry calendar for the next 60 days — domain names, public certificates on appliances, the Apple MDM push certificate and SSO signing certificates
   • Compare paid SaaS seats with active users — reclaim seats held by leavers and unassigned licences before the next invoice
   • Check support contracts and subscriptions renewing in the next 90 days — raise the renewal or the cancellation in time for procurement and notice periods
   • Update the network diagram, asset notes and runbooks — for this month’s changes, while the people who made them remember the details
   • List the month’s changes, major incidents and open problems — with ticket numbers, so the report explains what moved the figures
6. 6
   Phase 6

   Phase 6: Monthly Summary & Sign-off

   5 tasks

   The named approver signs off the month. The checklist halts at the sign-off task, so nothing reaches a client until the numbers have been checked.

   • Complete the monthly figures table — patch compliance, backup success, restore test result, MFA coverage, open exceptions and expiries due
   • Compare each figure with last month — a measure that slips two months running needs an owner, even if it still meets target
   • List every finding with its ticket number and owner — a finding with no ticket will be found again next month
   • Sign off the month — the approver named in Phase 1 records Approved or Not approved, with a reason if not approved
   • Carry open items into next month’s run — add them as comments on next month’s first task so they are checked first
7. 7
   Phase 7 — MSP Clients Only

   Phase 7: Client Report

   5 tasks

   Its tasks appear only when the run is for an MSP client. Internal IT teams stop at the Phase 6 sign-off.

   • Turn the monthly figures into the client’s report — plain language and trends, not raw tool exports
   • List the recommendations that need a client decision or budget — hardware reaching end of support, licence shortfalls, risks the client must accept in writing
   • Record hours used against the support agreement — so out-of-scope work is visible before the invoice goes out
   • Send the report to the client contact — attach the report and book a review call for anything that needs a decision
   • Log the client’s decisions — approved, declined or deferred, so next month’s run starts from what the client agreed