MSP New Client Onboarding Checklist: Signed Quote to First QBR in 90 Days
New client onboarding is the 90 days between the signed quote and the first QBR, and it decides whether the client stays a good fit or turns into a ticket fire you priced too low.
Most MSPs have a checklist for the technical part: push the agents, set up backup, add the users to the PSA. Fewer have one for the parts that cause trouble later. Nobody wrote down what sales promised. The client never sent the domain registrar login. The assessment that was supposed to happen in month one quietly became "we'll do it at the first QBR," and the first QBR never got booked.
This checklist covers the whole stretch in three phases, with an owner for each step and a list of what the client owes you. Copy it, cut what does not apply, and run every new client through the same version.
The 90 days at a glance
| Phase | Days | Goal | Owner |
|---|---|---|---|
| Handoff and access | 0 to 7 | Know what was sold, get the keys, start the cutover | Onboarding lead, with sales |
| Baseline | 8 to 30 | Write down what the environment really looks like | Engineer, with the vCIO |
| Decisions | 31 to 90 | Turn the baseline into decisions, a roadmap, and a QBR date | vCIO or account lead |
Notice who owns the last phase. Onboarding that ends when the agents are green leaves the most valuable part (the first real conversation about the client's environment) to chance. The vCIO should be on the project from day one, even if they only show up for the kickoff and the gap review.
Days 0 to 7: handoff and access
1. Run the internal handoff from sales
Do this before anyone talks to the client. Thirty minutes, sales and the onboarding lead, with the signed quote on the screen.
- What exactly was sold: services, seat count, devices, sites, and any project work.
- What was excluded, in writing. If the quote or scope of work has an exclusions list, read it out loud.
- Anything said on the sales calls that is not in the quote. "We told them we'd look at their phones" counts.
- Who the decision maker is, who the day-to-day contact is, and who left the last MSP angry.
- Why they switched. The discovery call notes usually have this, and it tells you which problem the client will judge you on first.
If sales promised something the quote does not cover, fix it now with a change order or a clear no. It only gets more expensive after the client has heard yes.
2. Hold the client kickoff
One meeting, the decision maker in the room. Cover:
- The cutover date and what changes for users that day.
- How users get help: the support email, phone number, portal, and hours.
- Who on the client side can approve work, purchases, and new users.
- The access and documents you need, with a due date for each (the full list is below).
- The day-30 baseline review and roughly when the first QBR will land.
Send a one-page summary the same day. It will be the document you point to in week three when the registrar login still has not shown up.
3. Get admin access and break-glass accounts
Get your own access before the outgoing provider loses theirs. Work through:
- Microsoft 365 or Google Workspace admin, under named accounts or partner relationships with the least privilege you need (GDAP if you work through Microsoft's partner program).
- Domain registrar and DNS host.
- Firewall, switches, wireless controllers, and VPN.
- Line-of-business applications and any vendor portals the client depends on.
- At least one documented break-glass account for the client's identity platform, stored where two people at your MSP can reach it.
Write down every account you could not get and who owns it. A missing registrar login on day five is an annoyance. On the day the domain expires, it is an outage.
4. Deploy your stack
Roll out RMM, EDR, backup, and remote access in a deliberate order. Most teams start with RMM so they can see the devices, then security, then backup.
- Remove the previous provider's agents only after yours report in.
- Keep a list of devices that could not take an agent and why: too old, unsupported OS, owned by a vendor, or nobody could find it.
- Start the first backup jobs and confirm they completed. A job that was scheduled is not the same as a job that finished.
That exception list becomes input for the next phase. Every device on it is either a standards gap or a scoping question.
Days 8 to 30: the baseline
5. Capture the baseline assessment
By day 30 you should be able to describe the environment on one page. Use a consistent template, such as the MSP technology assessment template, so every client's baseline answers the same questions.
| Area | What to record |
|---|---|
| Devices | Count by type, age, OS version, and warranty status |
| Licensing | Microsoft 365 and other SaaS licenses, assigned and unassigned |
| Identity | MFA coverage, admin accounts, stale accounts, conditional access in place |
| Backup | What is protected, where it lands, retention, and the last restore test |
| Security | EDR coverage, patch status, email security, open alerts from the rollout |
| Network | Firewall model and support status, ISP circuits, wireless, segmentation |
| Documentation | What the previous provider handed over and what is missing |
| Exceptions | Everything that does not meet your technology standards |
Date the baseline and keep it. It is the "before" picture for every QBR that follows, and it is how you show the client what changed because they hired you.
6. Run a restore test and a first ticket review
Two small checks that catch most onboarding surprises:
- Restore test. Restore one real file and, if the client has servers, one system. Do it before day 30 so the first restore is not during an incident.
- First ticket review. Pull every ticket from the first few weeks. Look for repeat problems, users who call about everything, and requests that sit outside the scope. Those patterns show up in your margin long before they show up in a survey.
Out-of-scope requests found here are the cheapest ones to handle. Name them, quote them, or add them to the roadmap. Doing them for free in month one teaches the client that the scope is a suggestion.
Keep the onboarding baseline on the client record
Build the assessment from reusable sections, turn findings into proposed work and roadmap items, and carry the approved scope into the quote. Free plan, no credit card.
Days 31 to 90: decisions
7. Review the gaps with the client
This is the meeting most onboarding plans skip. Take the baseline, list the gaps, and sort each one into three buckets:
| Bucket | What it means | Example |
|---|---|---|
| Accept | The client knowingly lives with it, and you have it in writing | An old plotter on an unsupported OS that only the architect uses |
| Fix now | Risky enough to quote before the first QBR | No MFA on the admin accounts, or backups that never completed |
| Plan later | Real, but it can wait for budget | Workstations that will age out of warranty next year |
Get a named decision on each item. "Accept" without a signature is how an MSP ends up owning a risk the client chose. The gap analysis workflow post covers how to run this conversation so every item leaves the room with a decision.
The fix-now items usually become the first project quote. Scope them properly. A quote approval checklist helps keep that first project from becoming the one you lose money on.
8. Draft the first roadmap
Put the plan-later items on a dated roadmap with rough budget ranges, one or two quarters at a time. Keep it short. A first roadmap with six items the client understands beats a 40-line spreadsheet nobody opens. The client roadmap guide shows the format.
9. Book the first QBR and log the renewal dates
Before day 90:
- Book the first QBR on the decision maker's calendar, not the day-to-day contact's.
- Log agreement, license, warranty, domain, and certificate renewal dates. The renewal calendar template gives you the fields.
- Set the client's first health check. If you score clients, mark new ones as onboarding for the first 90 days so their noisy early ticket numbers do not skew the client health score.
The first QBR should open with the baseline, what you fixed, and what the client decided. That is a better story than ticket counts, and it is already written if you did the first 60 days.
What the client owes you
Put this list in the kickoff summary with a due date next to each item. Most onboarding delays come from this side of the table, and a dated list makes that visible without an argument.
- Admin credentials or partner access for email, identity, domain, DNS, and the firewall.
- Contact details and account numbers for ISPs, line-of-business vendors, and the phone provider.
- The previous provider's handover: documentation, passwords, backup details, and open issues.
- A current user list with roles, plus who can approve new users and purchases.
- Any compliance requirements, cyber insurance questionnaires, or audit dates you need to know about.
- A named decision maker who will attend the gap review and the first QBR.
Copy the onboarding checklist
Paste this into the client record or your project template:
Client:
Signed date:
Cutover date:
Onboarding lead:
vCIO / account lead:
DAYS 0 TO 7: HANDOFF AND ACCESS
[ ] Internal handoff from sales (scope, exclusions, verbal promises, contacts)
[ ] Client kickoff held, summary sent
[ ] Identity platform admin access (named or partner accounts)
[ ] Break-glass account documented
[ ] Domain registrar and DNS access
[ ] Firewall, network, and VPN access
[ ] Line-of-business and vendor portal access
[ ] RMM deployed, previous agents removed after check-in
[ ] EDR deployed
[ ] Backup deployed, first jobs completed
[ ] Agent exception list recorded
DAYS 8 TO 30: BASELINE
[ ] Baseline assessment captured and dated
[ ] Standards exceptions listed
[ ] Restore test completed
[ ] First ticket review done, out-of-scope requests flagged
DAYS 31 TO 90: DECISIONS
[ ] Gap review held with the decision maker
[ ] Each gap marked accept / fix now / plan later, with a named decision
[ ] Fix-now items scoped and quoted
[ ] First roadmap drafted and shared
[ ] First QBR booked
[ ] Renewal dates logged
[ ] Client marked as onboarding in health scoring until day 90
CLIENT OWES US (with due dates)
[ ] Admin credentials or partner access
[ ] Vendor and ISP contacts
[ ] Previous provider handover
[ ] User list and approvers
[ ] Compliance and insurance requirements
[ ] Named decision maker for gap review and QBR
When a client leaves two years from now, the offboarding checklist is the other end of this one. Clients who were onboarded with a dated baseline and signed decisions are much easier to hand over cleanly.
Where Scopable fits
The checklist works in a spreadsheet. The part that tends to fall apart is days 8 to 90, when the baseline, the gap decisions, the roadmap, and the first project quote live in four different places.
Scopable's assessment and scoping workflow starts from the client record. You build the baseline from reusable assessment sections (including Microsoft 365 data where the account has the right connections), document gaps and open questions, and turn findings into proposed work, risk notes, roadmap items, or exclusions before anyone prices them. The approved scope carries into the quote. Scopable is not an automatic scanner for every device in the environment, and the engineer still owns the judgment on each finding. It cuts the retyping between the assessment, the roadmap, and the first quote.
Frequently Asked Questions
How long should MSP new client onboarding take?
Plan for about 90 days from the signed quote to the first QBR. The first week covers the sales handoff, the client kickoff, admin access, and agent rollout. By day 30 the MSP should have a dated baseline assessment, a restore test, and a first ticket review. Days 31 to 90 turn the baseline into gap decisions, a first roadmap, and a booked QBR.
What should an MSP baseline assessment capture during onboarding?
Record devices by type, age, and warranty, Microsoft 365 and SaaS licensing, identity and MFA coverage, backup scope and the last restore test, EDR and patch status, network equipment and support status, missing documentation, and every exception to your technology standards. Date it and keep it as the before picture for future QBRs.
What does a new client need to give an MSP during onboarding?
Admin credentials or partner access for email, identity, domain, DNS, and the firewall, vendor and ISP contacts, the previous provider's handover, a current user list with approvers, any compliance or cyber insurance requirements, and a named decision maker for the gap review and first QBR. Put a due date next to each item in the kickoff summary.
