The first month of a managed IT engagement decides whether the next year is calm or chaotic. Rush it and you inherit unknown devices, undocumented passwords and a client who thinks the RMM agent broke their printer. Drag it out and the client wonders what they are paying for.
Here is a 30-day plan that works for companies from ten to a few hundred seats. The timing scales, the order does not.
Week 1: discovery and access
Start with people, not tools. Sit down with the owner or the office manager and ask what breaks, what they are afraid of, and what they have been putting off. Then get every credential they have, in a session where you enter them straight into your password vault rather than into an email.
Run a network scan from inside each site and export a device list. Compare it with what the client thinks they have. The gap is your real inventory. Log into the firewall, the switches, the domain controller or identity tenant, and the backup system, and take screenshots of the current state before you change anything.
- Domain or tenant admin, firewall admin, ISP portal, DNS registrar, backup console
- Line-of-business vendors and their support contacts
- Licensing: Microsoft 365 or Google Workspace counts, antivirus, any per-server software
- Physical: server room access, rack layout photo, UPS model, ISP circuit IDs
- A written list of who is allowed to request changes
nmap -sn 192.168.10.0/24 -oG - | awk '/Up$/{print $2}'Week 2: agent rollout and baseline
Deploy the RMM agent in rings, not all at once. Start with your own test machine at the client, then the IT-friendly staff, then everyone else. Use the identity platform to push it (Intune, Group Policy, or an MDM for Macs) so you are not walking desk to desk.
Once agents report in, capture a baseline: OS versions, pending patches, disk encryption state, local admin accounts, installed software. Do not fix things yet. You need the picture first, and the client needs to see it too.
- Deploy the agent to 2 or 3 test devices and confirm inventory, remote control and scripting work
- Push to 10 percent of the fleet via Intune or Group Policy and wait 48 hours
- Push to the remainder, then chase the stragglers by hand (laptops that never come in, machines in a closet)
- Export the baseline report and highlight the top five risks in plain language
Get-CimInstance Win32_OperatingSystem | Select-Object Caption, Version, LastBootUpTimeWeek 3: documentation and quick wins
By now you know enough to write the runbook. Document each site as a page: ISP, public IPs, firewall model and rules summary, VLANs, Wi-Fi SSIDs, printers, and the physical location of anything that needs a person to reboot it. Document each server and each cloud tenant the same way.
Then pick quick wins that the client will notice. Turn on MFA for every admin account. Fix the backup job that has been failing quietly. Replace the shared 'office' password with individual accounts. Each of these is a small ticket that proves the relationship is working.
- Site page: network diagram, addressing, credentials linked from the vault
- Server page: role, OS, backup job, dependencies, restart order
- Application page: vendor, support contact, licence renewal date, who uses it
- Contact page: escalation order on the client side and on yours
Week 4: stabilize and review
The last week is for finishing the patch baseline, closing the onboarding tickets, and holding the first review. Show the client the before and after: number of devices discovered vs expected, patches applied, backup status, accounts secured. Then show the list of things that need budget: end-of-life hardware, unsupported software, single points of failure.
Agree on the ticket process. Where do staff send requests, what counts as urgent, who on the client side can approve purchases. Put the next quarterly review on the calendar before you leave the room.
Frequently asked questions
What if the previous provider will not hand over credentials?
Escalate in writing with a deadline and, in parallel, plan to reset what you can from a position of control: domain admin via a physical console, firewall via factory reset during a window, cloud tenants via the billing owner. Document every step for the client.
Do we really need a full scan of the network?
Yes. Clients consistently underestimate their device count. The devices they forgot about are the ones with default passwords and no patches.
Can onboarding be shorter than 30 days?
For a small office with a clean environment, yes. The order still matters: access and discovery first, agents second, documentation third, fixes last.
Takeaway
Onboarding is discovery, access, agents, documentation, and only then repairs. Do it in that order and the client sees steady progress every week. Skip the first steps and every later ticket takes twice as long because nobody knows what is on the network.