Discovery: learning what you have
The first stage is finding out exactly what exists. The provider will list every computer, server, printer, network device and cloud service, along with licences, warranties and the software each team relies on. Some of this comes from scanning tools, and some from walking around the office and talking to the people who use the systems every day.
Expect questions you may not have considered. Where is your domain registered? Who supplies your internet connection and phone system? Which staff work from home or travel? What happens if a particular system stops? The answers help the provider understand not just your technology but how your business uses it, which shapes every later recommendation and the way support requests are prioritised.
Access and handover
Next comes access. The provider needs admin rights to Microsoft 365 or Google Workspace, your firewall, backup systems and any servers. If you are switching from another provider, this often involves coordinating a handover of credentials. If you are moving from no provider at all, it may mean recovering accounts that were set up years ago by someone who has since left.
A careful provider will create its own named admin accounts rather than relying on shared logins, and will make sure your business keeps independent break-glass access. They should also check for unknown or stale admin accounts and remove them, which is often the first meaningful security improvement of the whole engagement.
Rolling out tools
With access sorted, the provider installs its standard tools. Typically that means a monitoring and remote support agent on each computer, endpoint protection, a patching policy and, if included, backup for Microsoft 365 and any servers. Email filtering and multi-factor sign-in may be set up or tightened at this stage too.
Most of this happens in the background, but staff may notice a restart, a new icon or a prompt to set up multi-factor sign-in. A good provider warns people beforehand and explains what to expect. Rolling tools out in planned batches rather than all at once reduces disruption and makes it easier to spot anything that conflicts with your existing software.
Fixing urgent gaps
Discovery often uncovers problems: failing backups, unsupported operating systems, a firewall with default settings, staff without multi-factor sign-in, or old accounts still active. The provider should sort these into urgent and non-urgent and tell you plainly what each means for the business, in plain language rather than technical shorthand, so you can make informed decisions.
Urgent security gaps are usually fixed straight away as part of onboarding. Larger items, such as replacing hardware that is out of support, should be written up with a recommendation and a quote for you to approve. Be wary of a provider that finds problems but does not tell you, or one that fixes things without asking when money is involved. You should always see a written quote and give approval before any work that carries a cost beyond the agreed plan begins.
Documentation and the first review
By the end of onboarding, the provider should have written documentation of your environment: network layout, systems list, admin accounts, licences, warranties, backup details and key contacts. Ask for a copy. It belongs to your business and is valuable whether or not you stay with that provider for the long term.
The onboarding usually ends with a review meeting. The provider summarises what they found, what they fixed, what still needs attention and what they recommend over the coming year. This is a good moment to ask questions, set priorities and agree how often you will meet from here on. It is also a chance to give feedback on the onboarding itself while it is fresh.
What your staff need to do
Staff involvement is usually light. They need to know how to request help, set up multi-factor sign-in if it is new, and allow the occasional restart. A short internal email and perhaps a brief session explaining the help desk are enough for most offices of any size. Keep a short written note of the new help desk details somewhere easy to find, such as the staff intranet or a card at reception.
Encourage staff to report problems through the proper channel from day one, even small ones. Early requests help the new provider learn your quirks quickly, and patterns in those first weeks often reveal deeper issues worth fixing. The more the team uses the help desk early on, the faster support improves for everyone.
In short
- Onboarding typically takes a few weeks for a small office.
- Discovery, access, tool rollout, gap fixes and documentation are the core steps.
- Urgent security gaps are usually fixed during onboarding; bigger items are quoted.
- Ask for a copy of the documentation at the end.