Last verified October 16, 2026, against the CISA, FTC, and Microsoft pages linked below. Who publishes these notes is on the about page.
Client onboarding is the two weeks where I find out whether we can work the account on a Monday without calling the last technician. The contract is already signed. What is missing is the registrar login, the backup that has never been restored, and the Global Administrator mailbox that also reads invoices.
This is the runbook I walk with a new managed client. The fillable version is the new-client onboarding runbook, listed at $79 on the digital products page.
Before the first remote session
I want four facts on paper before I touch a tenant.
The scope: which sites, which companies inside the tenant, and what is explicitly out of scope. A "we manage everything" sentence becomes an argument the first time a line-of-business app breaks. If that app breaks, the vendor who sold it is the support path. I write the name of that vendor on the scope page so nobody asks me to improvise a fix.
The approver: one person who can say yes to a change, and a second person for when the first is on a plane. CISA's Cyber Essentials says, "Learn who to call for help (outside partners, vendors, government/industry responders, technical advisors and law enforcement)." I want that list in both directions: the after-hours contact named in the agreement, plus their bank-fraud line, registrar, and cyber insurance carrier.
The obligations: I ask which rules they have to follow, and whether the cyber insurance application or the policy requires multi-factor authentication, offline backups, or endpoint detection. I write the answer next to the scope. I do not interpret the policy for them. If the form and the tenant disagree, that is an open item for the approver and the carrier.
The emergency accounts: who can get into the tenant, the firewall, the backup, and the domain if I am unavailable. I write where the keys live.
The previous provider: the date they lose access, and the list of shared passwords they knew. I do not start serious work until that date is on the calendar. Overlap is how two companies both think they own the firewall.
Access, written down
I make one table. Each row is a system. The columns are the URL, the account that administers it, whether multifactor authentication is on, where the recovery method lives, and who still has access from the old provider.
The rows I refuse to skip:
- Microsoft 365 or Google Workspace, including the break-glass admin if one exists
- Domain registrar
- DNS host, if it is not the registrar
- Website host
- Firewall and the account that can change VPN users
- Backup console, separate from the server admin
- Password vault, once we have one
- RMM, once the agent is ours
- Line-of-business apps that would stop payroll or shipping
CISA's Cyber Essentials tells leaders to learn who is on the network and to keep inventories of user accounts, vendors, and partners. This table is that inventory for the systems I will actually be blamed for. A laptop inventory comes later. If I cannot log into the tenant, the laptop list is a rumor.
Shared logins go into a business password manager the same week, not into a spreadsheet the owner emails around. The directory's password manager category is where I send someone who does not have one yet. I do not pick a product from this page. CISA says to use unique passwords for user accounts. The FTC's small-business cybersecurity page says never to reuse passwords. The vault is how a small office does that without a ritual.
Identity, before I add our own admin
I export the admin list on day one. Every Global Administrator, every registrar admin, every firewall admin. Names that have left the company come off the same day. CISA says to grant access and admin permissions on need-to-know and least privilege, and to start multifactor authentication with privileged, administrative, and remote-access users. The starter actions say to require multifactor authentication whenever possible, starting with those same users.
Daily mail stays on a normal account. Admin is a second account. The owner's everyday mailbox is the one a phish wants, because it is open all day and it can reset everyone else.
If the client is on Microsoft 365 and they do not already run Conditional Access, I use Microsoft's security defaults as the baseline. That page says the protections are available at no extra cost, and its comparison table lists required licenses as "None." It also says that if the organization has Entra ID P1 or P2, security defaults is probably not right for them. The Entra licensing page says Entra ID P1 is included in Microsoft 365 Business Premium. I read that page for the SKU they actually own before I tell them to turn Conditional Access on.
Microsoft's security defaults page also says to keep two cloud-only emergency access accounts permanently assigned Global Administrator. The emergency access article says to make them cloud-only on the *.onmicrosoft.com domain and to satisfy multifactor authentication with a FIDO2 passkey, which it recommends, or with certificate-based authentication. I do that before I remove the last personal admin, not after. If enabling the switch breaks a copier or a script, I follow Microsoft's own documentation and Microsoft's support. I do not debug their tenant from a checklist.
Sign-in log retention is seven days on Entra ID Free and 30 days on P1 and P2. I look at legacy authentication in that window during onboarding, because a scanner that only sends mail on Fridays will disappear from a free tenant's logs if I wait a month. Microsoft's article on blocking legacy authentication is the click path: Reports Reader, sign-in logs, Client App column, legacy protocols, and the same filter on non-interactive sign-ins.
Assets and the network
CISA tells leaders to learn what is on the network and to keep inventories of hardware and software. I take a simple list: laptops, desktops, servers, phones that hold mail, printers, and the network boxes. Who has it, how old it is, and the operating system.
Unsupported systems get a date. Microsoft's Windows 10 Home and Pro lifecycle page says, "Windows 10 will reach end of support on October 14, 2025," and that existing LTSC releases follow their own dates. That page shows support dates in the Pacific Time Zone, and the Home and Pro retirement timestamp in the table is 10/15/2025 6:59:59 AM. A Home or Pro PC still on Windows 10 is past that date unless it is enrolled in Extended Security Updates. Microsoft's consumer ESU page says eligible devices need to be running "Windows 10, version 22H2 Home, Professional, Pro Education, or Workstations edition," and that enrolled coverage continues through October 12, 2027. That page says enrollment will not be offered for devices in kiosk mode, devices joined to an Active Directory domain or Microsoft Entra, or devices enrolled in MDM, and that "Microsoft Entra registered" devices can use the consumer program. Microsoft's commercial ESU page says, "Enrolled PCs belonging to a commercial or educational organization can receive security updates for a maximum of three years after end of support for Windows 10." I write which program the PC is on, or that it is on neither. CISA's Cyber Essentials says, "Replace unsupported operating systems, applications and hardware." I put the replacement on a date the client picked, and I write the date in the runbook. I do not leave a machine with no enrollment and no date.
The FTC says to change preset router passwords and the default router name, and to keep the router's software current. A separate line says that after you set up a router, change the default username and password and turn off remote management. Guest Wi-Fi does not get a route to the file server. If a firmware update fails, that is the network vendor's support.
The FTC also says to encrypt devices that contain sensitive personal information, including laptops. I confirm the recovery key is stored somewhere that still exists when the laptop is stolen. A key that lives only on the laptop is not a key.
Agents
I roll three agents, and I confirm each one has checked in before I call the machine done: the RMM, the endpoint detection product, and the backup. I write the date the console showed the device. A row that says "installed" on a spreadsheet, and is missing from the console, does not count. If an installer fails, I use that vendor's support and I keep the ticket number. I do not troubleshoot their agent from this runbook.
Backups, including the restore
I list what would stop the business: accounting files, the shared drive, email, and the line-of-business database. For each one I write where it lives and what copies it. "It is in Microsoft 365" is availability. A delete can sync.
CISA's Stop Ransomware page says to maintain offline, encrypted backups and to test them regularly. Cyber Essentials says to protect backups with physical security, encryption, and offline copies. The FTC's phishing guidance says to back up data and make sure those backups are not connected to the network.
During onboarding I restore one file and one folder, and I time it. I write the date, the person who watched, and where the success mail goes. That mail must land in a shared mailbox a current employee reads. The classic failure is an alert addressed to someone who left in April.
If the client has no third-party copy of Microsoft 365 or Google Workspace, I write that as an open decision, not as a silent pass. Retention and the recycle bin expire. Whether they buy a backup is their decision after they see the restore gap. The backup category in the directory is a list of products, not a recommendation. If a restore errors, use that vendor's support and write down the ticket number.
Documentation that a stranger can use
I do not call the account onboarded until a second person can find three things without asking me: the firewall admin URL, the backup login, and the steps for the restore we just did. Those three go into the documentation system, or into a written page if they do not have one yet. A folder of old network diagrams is not that test.
I also write the "who to call" sheet CISA describes, and I print it. When the network is down, nobody is opening the PDF on the file server that is down. The sheet has the internet provider and account number, the phone vendor, the registrar, the cyber carrier, and the bank fraud line.
CISA lists policies for transfers and terminations as part of knowing who is on the network. I leave them a one-page offboarding list: disable the account the same day, rotate shared passwords that person knew, transfer the mailbox and files, collect the laptop, and remove them from the admin table.
How people open a ticket
Users get one path, written on the same printed sheet as the after-hours number: the portal or the mailbox, what belongs in the subject, and what counts as an emergency. The week the agents are in, I send a short welcome note with that path and the approver's name. I do not publish three ways in and then guess which queue the printer request used.
The previous provider's last day
On the morning they lose access I confirm:
- Their admin accounts are disabled, not merely hidden.
- Shared passwords they knew are changed, including the firewall, the registrar, and any scanner that sent mail as a user.
- The RMM agent is ours, or theirs is scheduled for removal on a date we both have.
- Backup jobs are running under an account they cannot reset.
- The documentation they promised is actually in our vault, not "in the ticket history."
I send the client a short note the same day: what we can get into, what we cannot, and the open dates (unsupported PCs, the Microsoft 365 backup decision, anything still in the old provider's tenant).
The first 30 days
Week one is access, admins, and the restore test. Week two is the asset list, the unsupported-OS dates, and the password vault. Week three is alerts pointed at a mailbox we read, and a look at legacy authentication if they are on Microsoft 365. Week four is the offboarding page and a meeting where the approver sees the open items. The result I owe them is a written list of open items, working logins, and one file restored on purpose.
If a product on the account is broken, use that vendor's support. Start with the admin export and one restore.
How a paid PDF is delivered is on the site FAQ.
Works Cited
"About." ITOps Desk, itopsdesk.org/about. Accessed 16 Oct. 2026.
"Cyber Essentials." CISA, www.cisa.gov/resources-tools/resources/cyber-essentials. Accessed 16 Oct. 2026.
"Cybersecurity for Small Business." Federal Trade Commission, Sept. 2025, www.ftc.gov/business-guidance/small-businesses/cybersecurity. Accessed 16 Oct. 2026.
"Digital products." ITOps Desk, itopsdesk.org/products. Accessed 16 Oct. 2026.
"FAQ." ITOps Desk, itopsdesk.org/faq. Accessed 16 Oct. 2026.
Microsoft. "Block legacy authentication with Conditional Access." Microsoft Learn, 24 Mar. 2026, learn.microsoft.com/en-us/entra/identity/conditional-access/policy-block-legacy-authentication. Accessed 16 Oct. 2026.
Microsoft. "Configure Security Defaults for Microsoft Entra ID." Microsoft Learn, 16 Oct. 2026, learn.microsoft.com/en-us/entra/fundamentals/security-defaults. Accessed 16 Oct. 2026.
Microsoft. "Extended Security Updates (ESU) program for Windows 10." Microsoft Learn, 17 Nov. 2025, learn.microsoft.com/en-us/windows/whats-new/extended-security-updates. Accessed 16 Oct. 2026.
Microsoft. "Manage emergency access admin accounts." Microsoft Learn, 5 June 2026, learn.microsoft.com/en-us/entra/identity/role-based-access-control/security-emergency-access. Accessed 16 Oct. 2026.
Microsoft. "Microsoft Entra data retention." Microsoft Learn, 25 Mar. 2026, learn.microsoft.com/en-us/entra/identity/monitoring-health/reference-reports-data-retention. Accessed 16 Oct. 2026.
Microsoft. "Microsoft Entra licensing." Microsoft Learn, 18 June 2026, learn.microsoft.com/en-us/entra/fundamentals/licensing. Accessed 16 Oct. 2026.
Microsoft. "Windows 10 Consumer Extended Security Updates (ESU)." Microsoft Windows, www.microsoft.com/en-us/windows/extended-security-updates. Accessed 16 Oct. 2026.
Microsoft. "Windows 10 Home and Pro." Microsoft Learn, learn.microsoft.com/en-us/lifecycle/products/windows-10-home-and-pro. Accessed 16 Oct. 2026.
"Stop Ransomware." CISA, www.cisa.gov/stopransomware. Accessed 16 Oct. 2026.