Signing a new managed services client is the easy part. Then your team has to take over an environment somebody else built, often with no documentation, credentials scattered across sticky notes and an outgoing provider who is in no hurry to help. Everything you later promise the client, from the SLA and patching to backups and the monthly report, depends on getting that takeover right. This free MSP client onboarding checklist covers the technical side of onboarding: collecting and securing access, running discovery, deploying the RMM, EDR and backup agents, building the documentation, going live on the service desk and closing out with a 30-day review. It is written for service managers, onboarding engineers and vCIOs who want every new client onboarded the same way, whichever engineer is assigned. A conditional phase handles the handover from an incumbent IT provider, so it only appears when there is one.
Most client onboarding advice is about the relationship: a kickoff call, a welcome email, introductions to the account team. That matters, and our general client onboarding checklist covers it well. An MSP has a second, harder job running alongside it. You are taking operational responsibility for a network, a cloud tenant and every device in the building, usually within a few weeks, and usually from someone who knew it better than you do.
The failures in MSP onboarding are rarely dramatic. They are small gaps that stay hidden until they cost something: a laptop that never got the RMM agent and so was never patched, a domain registrar login that only the old provider had, a backup that was configured but never tested, a firewall rule nobody can explain. A checklist closes those gaps by making every step explicit and making discovery reconcile against deployment, so that “every device” means every device.
Covers: kickoff, contacts, billing setup, welcome pack, expectations.
Done when: the client knows who to call and how to raise a ticket.
Risk if missed: a confused client and a slow start.
Covers: credentials, discovery, agents, backups, documentation, cutover.
Done when: every in-scope device is managed, protected, backed up and documented.
Risk if missed: an unmanaged device, an untested backup or a lockout, discovered during an incident.
Seven phases take a new client from signed agreement to steady-state service. Phase 3 appears only when an incumbent IT provider is handing over.
Credentials go straight into your password vault or documentation platform. Never collect them by email or spreadsheet.
Shown only when the client is moving from another IT provider. Conditional logic removes it for clients with no incumbent.
Onboarding time depends on the size of the client and the state of what you inherit. A ten-seat office with a cooperative outgoing provider can be done in a fortnight, while a multi-site client with no documentation can take a quarter. Most small and mid-sized clients fit a 30-day plan like the one below. Agree it with the client at kickoff, so everyone knows when the cutover will happen.
| When | What happens | Done when | Checklist phase |
|---|---|---|---|
| Before day 1 | Sales handover, PSA setup, kickoff | Cutover date and authorised contacts agreed | Phase 1 |
| Week 1 | Credentials collected, incumbent handover requested, discovery run | Admin access verified and a full device inventory exists | Phases 2–4 |
| Week 2 | RMM, EDR and backup agents deployed | Agent list matches the inventory, and the first backup has been test-restored | Phase 5 |
| Week 3 | Documentation built, service desk cutover | Any engineer can support the client from the documentation alone | Phases 6–7 |
| Day 30 | 30-day review and handover to the service team | Remediation plan presented and recurring schedules running | Phase 7 |
Two rules make the timeline hold. First, don’t cut over the service desk until the RMM agent is on every device you are responsible for. Tickets from machines you can’t see are the fastest way to miss an SLA in week one. Second, don’t fix everything you find during discovery. Record it, price it and present it at the 30-day review, so remediation is agreed and paid for rather than absorbed.
Build the onboarding process once and launch it for each new client with the client name, service tier and onboarding engineer filled in. Conditional logic adds the incumbent handover phase only when there is one, so you don’t need a separate version for every situation.
When three clients are onboarding at once, the grid view shows where each one stands: who is still waiting for credentials, whose agents are deployed and which cutover dates are close. Nothing depends on one engineer remembering what they were up to.
Share a read-only view of the onboarding checklist with the client’s contact, under your brand, so they can see progress without chasing. It shows your process to a new client in their first week, when they are most likely to be watching.
Client onboarding is the first process most MSPs standardise, and the one with the most visible payoff. The MSP process management guide covers the other core processes to standardise next, and CheckFlow for MSPs shows how they run across every client from one place.
Once the client is live, the Monthly Managed Services Report Checklist takes over. The baseline findings from discovery become the first recommendations in the client’s first monthly report and QBR.
It is the process of taking over operational responsibility for a new client’s IT. It covers collecting and securing administrative access, discovering and documenting the environment, deploying your management, security and backup tools, cutting the service desk over and reviewing the result with the client. It differs from general client onboarding because the MSP is inheriting live systems, not just starting a relationship.
For most small and mid-sized clients, two to six weeks. The main variables are the number of sites and devices, how much documentation exists and how cooperative the outgoing provider is. Agree a target cutover date at kickoff and track against it. If discovery turns up far more than expected, move the date deliberately rather than letting it slip.
A general client onboarding checklist, like the one in our client onboarding guide, focuses on the relationship: kickoff, welcome, expectations and first deliverables. This template covers the technical takeover specific to managed services: credentials, incumbent handover, discovery, agent deployment, documentation and service desk cutover. Most MSPs run both, with the account manager owning the first and the onboarding engineer the second.
Start early and put requests in writing, with deadlines. Most important accounts can be recovered by the client directly, because the domain registrar, the Microsoft 365 tenant and the licensing should be in the client’s name. Phase 3 checks exactly that. Where the outgoing provider controls something the client should own, the client usually needs to make the request, so brief them at kickoff.
Fix anything that is an immediate risk, such as an exposed remote desktop service or an admin account without MFA, and tell the client you have done it. Record everything else as a baseline finding with a recommendation and an estimate, and present it at the 30-day review. That gives the client a clear starting position and keeps remediation from quietly eating your onboarding margin.
Yes. The template is fully editable, and conditional logic can show or hide tasks by service tier. For example, it can add security awareness training setup only for clients on a security bundle, or add co-managed handover tasks when the client has its own IT staff. One template handles the variations without maintaining separate copies.
14-day free trial, no card required. The Business plan is $10 per user per month after the trial. Full details at checkflow.io/pricing.
