Changing IT providers is mostly about access, documentation and a security baseline. Here is the typical order of work in the first month, what to prepare before day one, and how to tell whether onboarding actually went well.<\/p>\n\n\n\n
Related guides<\/strong><\/p>\n\n\n\n Onboarding is how a new IT provider goes from knowing nothing about your environment to being able to support it, secure it and recover it. Done well, you end up with three things you may never have had before: an accurate record of your IT, admin access that your business controls, and a known security starting point.<\/p>\n\n\n\n Think of "the first 30 days" as a way to describe what a good onboarding covers, not a promised timetable. The order below is a typical sequence. A five-person office with Microsoft 365 and laptops moves faster than a multi-site organisation with on-premises servers, a phone system and a line-of-business app, and the services you choose change the pace too. For our own managed security service, for example, onboarding is as soon as 1 week, and within 4 weeks, depending on the services you choose. Some steps overlap. What matters is that none of them gets skipped.<\/p>\n\n\n\n The provider needs to know what exists before they can secure it. Expect them to document:<\/p>\n\n\n\n ASD’s guidance on moving to ASD Essentials asks organisations to continuously identify and document infrastructure, operating systems, applications, identities, credentials and data as distinct assets. You don’t need a framework to see why. An unknown laptop or forgotten admin account can’t be patched, monitored or removed.<\/p>\n\n\n\n Check:<\/strong> you receive a written asset and account list, and it matches what you know is out there. If you know of a device or account that isn’t on it, say so.<\/p>\n\n\n\n This is the part most likely to go wrong, and the part that matters most if the relationship with a previous provider ended badly.<\/p>\n\n\n\n Your business should own the keys.<\/strong> The new provider should get named admin accounts of their own, not a shared login. Your organisation should hold ownership of the Microsoft 365 tenant, domain registrations, DNS, firewall and any cloud subscriptions, with your own contact details on them.<\/p>\n\n\n\n Credentials never travel by email or text.<\/strong> Passwords should be shared through a password manager or entered in person, then changed. Any credential that a previous provider knew should be treated as known to someone outside the business and rotated.<\/p>\n\n\n\n The old provider’s access is removed and verified.<\/strong> That means their user accounts, any remote access tools they installed, VPN accounts, firewall admin accounts and saved credentials. In Microsoft 365, partners can hold delegated admin rights. Microsoft’s documentation shows that you can see and remove these on the Partner relationships<\/strong> page of the Microsoft 365 admin centre by selecting the partner and choosing Remove roles<\/strong>. Agree the timing with both providers so there’s no gap in support.<\/p>\n\n\n\n Emergency access is set up properly.<\/strong> Microsoft recommends two or more cloud-only emergency access ("break glass") accounts with the Global Administrator role, not tied to any one person, using phishing-resistant sign-in such as a passkey (FIDO2) security key, stored securely, monitored, and tested at least every 90 days. Microsoft also recommends assigning Global Administrator to fewer than five people.<\/p>\n\n\n\n MFA on admin accounts is tied to the business.<\/strong> If an admin account’s MFA is registered to a former staff member’s personal phone, fix that now.<\/p>\n\n\n\n Check:<\/strong> there’s an access register listing every admin account, who holds it and what it can reach. The previous provider’s accounts are shown as removed, with the date. Your business is listed as the owner of the tenant, domains and subscriptions.<\/p>\n\n\n\n A security-first provider applies a baseline early, because each item on it closes a common way in.<\/p>\n\n\n\n On backups, ASD’s ASD Essentials guidance is specific: regular backups to secure storage protected by "immutable, offline, logically isolated or equivalent controls", repositories isolated from primary systems, and regular testing to show recovery time and recovery point objectives can be met. A backup job that reports "success" is not the same as a restore that worked. Ask for the test.<\/p>\n\n\n\n On MFA, ASD’s guidance has moved to phishing-resistant MFA. Your provider should tell you where you stand now and what moving to phishing-resistant methods would involve, starting with admin accounts.<\/p>\n\n\n\n Check:<\/strong> you’ve seen the evidence column for each row, not just been told it’s done.<\/p>\n\n\n\n For most organisations, Microsoft 365 is where email, files and identities live, so it gets its own review. A typical review covers:<\/p>\n\n\n\n Check:<\/strong> you get a written list of findings ranked by risk, not a general "looks fine".<\/p>\n\n\n\n By this point the provider will have a list of findings. Good onboarding separates them into two groups.<\/p>\n\n\n\n Quick wins<\/strong> are low-cost, low-disruption fixes that reduce risk straight away. Common examples: turning on MFA for the last few accounts, removing a departed staff member’s access, deleting an external forwarding rule, enabling audit logging, or removing local admin rights from staff laptops.<\/p>\n\n\n\n Planned projects<\/strong> need budget, scheduling or a business decision. For example, replacing a server that’s leaving support, moving file shares to the cloud, segmenting the network, or replacing an unsupported line-of-business app. These should come back to you as a short written roadmap with the reason, the risk of waiting and the options, so you can decide.<\/p>\n\n\n\n Check:<\/strong> you have both lists in writing, the quick wins are marked done or scheduled, and every planned project has a decision owner on your side.<\/p>\n\n\n\n Expect a settling-in period after the switch, too. A good provider watches closely once they take over, fixes teething problems and tunes alerts before day-to-day service becomes routine.<\/p>\n\n\n\n Rather not run IT yourself?<\/strong> Our security-first managed IT looks after your users, devices, Microsoft 365 and network, with changes made carefully and written down.<\/p>\n\n\n\n\n\n
TL;DR<\/h3>\n\n\n\n
\n\n
In this post<\/h3>\n\n\n\n
\n\n
What is onboarding actually for?<\/h2>\n\n\n\n
\n\n\n\nStage 1: Discovery and documentation<\/h2>\n\n\n\n
\n\n
\n\n\n\nStage 2: Access handover, done securely<\/h2>\n\n\n\n
\n\n\n\nStage 3: The security baseline<\/h2>\n\n\n\n
\n\n
\n \nControl<\/th>\n What "done" looks like<\/th>\n Evidence to ask for<\/th>\n<\/tr>\n<\/thead>\n \n Multi-factor authentication<\/strong><\/td>\n On for every user, every admin and remote access. Legacy sign-in methods that can’t do MFA are blocked.<\/td>\n An MFA registration report showing no gaps, with any exceptions named and justified<\/td>\n<\/tr>\n \n Patching<\/strong><\/td>\n Operating systems and applications on every managed device are updated on a defined schedule, with unsupported software identified<\/td>\n A patch compliance report and a list of anything out of support<\/td>\n<\/tr>\n \n Backups<\/strong><\/td>\n Important data, apps and settings are backed up to storage that’s separated from production and protected from deletion, and a restore has been tested<\/strong><\/td>\n The backup scope, where copies are stored, and the date and result of a test restore<\/td>\n<\/tr>\n \n Endpoint protection<\/strong><\/td>\n Every laptop, desktop and server has managed endpoint protection reporting into one console<\/td>\n A device count from the console that matches the asset list<\/td>\n<\/tr>\n \n Admin privileges<\/strong><\/td>\n Day-to-day work happens on standard accounts. Admin rights are limited to people who need them.<\/td>\n A list of who has admin rights, and why<\/td>\n<\/tr>\n<\/tbody>\n<\/table><\/figure>\n\n\n\n
\n\n\n\nStage 4: Microsoft 365 review<\/h2>\n\n\n\n
\n\n
\n\n\n\nStage 5: Quick wins versus planned projects<\/h2>\n\n\n\n