T25 MSP client onboarding runbook
MSP client onboarding runbook
How Bluepeak IT brings Hartwell Dental Group under managed support across three locations in four weeks, without a service gap. Prepared by the Bluepeak IT onboarding team. Shared with the client's office manager so both sides can track the same sequence and know what is needed from them each week.
Sample template: the firm, people, clients and figures are fictional and shown for illustration only.
Live example from the Dashboards app, shown with Harborline Logistics's demo data.
Onboarding sequence by week
Week 1 closed with the asset scan below and a signed access agreement. Week 2 is in progress: the RMM agent is deployed to 51 of 58 endpoints, MFA is enrolled for 36 of 42 users, and the Riverside firewall access item below is holding up the security baseline for that site. Weeks 3 and 4 do not start until Week 2's access checklist is fully closed.
Asset discovery
| Site | Asset type | Count | Notes |
|---|---|---|---|
| Main St (HQ) | Servers | 2 | Windows Server 2019, imaging server EOL Dec 2026 |
| Main St (HQ) | Workstations and laptops | 24 | 3 still on Windows 10, flagged for upgrade |
| Main St (HQ) | Network gear | 1 firewall, 2 switches | Firewall firmware 2 versions behind |
| Riverside | Workstations and laptops | 16 | All current OS |
| Riverside | Network gear | 1 firewall, 1 switch | Firewall is client-owned, not yet under our management |
| Lakeview | Workstations and laptops | 18 | Includes 3 contractor laptops, personally owned |
| All sites | Phone system | 1 hosted PBX, 42 extensions | Vendor: third-party, admin access pending |
Access needed before Week 2 closes
Riverside firewall access is blocking the Week 2 security baseline
The Riverside firewall is still owned and managed by the client's previous provider. We cannot apply the standard MFA-on-VPN and geo-blocking rules until Priya Anand's team confirms the previous provider has released admin access. Owner: Priya Anand to request release by Sep 26. If not resolved by Sep 29, Riverside slips into Week 3 and the Oct 6 go-live moves for that site only; Main St and Lakeview stay on schedule.
Never put credentials in this page
Do not paste passwords, API keys, vault links or shared secrets into this runbook or any other shared document. All Hartwell Dental Group credentials live in the Bluepeak password vault, in a folder scoped to this engagement, accessible only to the assigned onboarding engineer and the account manager. If a credential appears in an email or chat during onboarding, rotate it immediately and log the exposure.
Site by site status
Primary site and phone system hub. RMM agent deployed to all 24 endpoints. Firewall firmware upgrade scheduled for Sep 27, after hours, with a 30 minute expected outage window. Server backup validated against the 3-2-1 standard on Sep 22.
Second largest site. 16 of 16 endpoints have the RMM agent; MFA enrollment is complete for all users. The site is otherwise ready, but see the firewall access warning above, which is the single item holding this site out of Week 2 completion.
Smallest site, 18 endpoints including 3 contractor-owned laptops. Contractor devices get a scoped device policy rather than full management, per the signed onboarding agreement. Standard rollout, no exceptions logged.
Handover sign-off
| Milestone | Owner | Status | Date |
|---|---|---|---|
| Access agreement signed | Priya Anand | Sep 15, 2026 | |
| Asset discovery confirmed accurate | Derek Moss and Priya Anand | Sep 19, 2026 | |
| Security baseline applied, all sites | Derek Moss | Target Sep 29, 2026 | |
| Backup validation report reviewed | Priya Anand | Target Oct 2, 2026 | |
| Support handover call and ticket portal walkthrough | Derek Moss | Target Oct 6, 2026 |
A milestone is not complete until both owners listed have confirmed it, not just the Bluepeak side.
We had two outages during our last provider's onboarding because nobody told us which firewall change was happening when. Seeing the week-by-week plan and knowing exactly what we owe you has made this feel controlled instead of chaotic.
What happens at go-live
Go-live means monitoring is live, not that work stops
On Oct 6, Hartwell Dental Group moves from onboarding support to standard managed support: 24 by 7 monitoring, the agreed ticket SLAs and the regular patch schedule begin. Items still open at that point, such as the Windows 10 upgrades, roll onto the standard project backlog with their own timeline, tracked outside this runbook.
How to use this template
Duplicate this page once per new client engagement. Replace the values below as discovery and each week's work confirm them; if a required value is not yet known, write Needs review next to it rather than estimating a date or count.
| Variable | Meaning | Required |
|---|---|---|
{{client.name}} | Client being onboarded | Required |
{{engagement.plan_tier}} | Support plan and number of sites covered | Required |
{{engagement.onboarding_engineer}} | Bluepeak engineer who owns the engagement | Required |
{{engagement.target_go_live}} | Agreed go-live date | Required |
{{site.asset_counts}} | Discovered asset counts per site from the Week 1 scan | Required |
{{access.outstanding_items}} | Access items not yet granted, with the owner who must grant them | Required |
{{handover.signoff_date}} | Date each handover milestone is confirmed by both owners | Optional |
Keep the credential-handling warning in every copy of this runbook and never replace it with an actual credential or vault link.