Documents and Access a Managed IT Provider Needs From You (Onboarding Requirements)
A practical list of the documents, inventories and administrative access a managed service provider will ask for, and how to hand over credentials safely.
Before a managed service provider (MSP) can take over support, you will need to provide an inventory of users, devices and software, administrative access to your key systems, vendor contacts, and any existing documentation such as network diagrams and backup records. You will also need to name an internal contact. The more complete the handover, the faster onboarding goes, and the less you pay for discovery work. Just as important: hand over credentials securely and keep your own copy of the master accounts.
The core document set
1. Users and roles
- Current employee and contractor list with job titles and departments.
- Which people need administrative rights and why.
- Shared mailboxes, distribution lists and service accounts.
- Pending hires and departures in the next few months.
2. Devices and equipment
- Computers, tablets and phones with make, model, approximate age and assigned user.
- Servers, physical or virtual, with their purpose and operating system.
- Firewalls, routers, switches and wireless access points.
- Printers, scanners, phone systems and specialty equipment such as lab devices or point-of-sale terminals.
- Warranty and support contract information, where you have it.
3. Software and licenses
- Productivity suite: Microsoft 365 or Google Workspace subscription details and license counts.
- Line-of-business applications, with vendor names and support contacts.
- Security software currently installed.
- License keys, renewal dates and the account that owns each subscription.
4. Network and connectivity
- Internet providers, account numbers, circuit speeds and support contacts.
- Existing network diagrams, if any.
- Static IP addresses, VPN setup and remote access methods.
- Details of each location.
5. Backup and recovery
- What is backed up, where, how often, and by whom.
- The most recent successful restore test, if one exists.
- Retention requirements from contracts, insurers or regulations.
6. Policies and compliance material
- Any written security or acceptable use policies.
- Cyber insurance policy and application, which often contains security promises you need to keep.
- Contracts or questionnaires from customers with security requirements.
- For healthcare, existing HIPAA risk assessments; for payment cards, your PCI self-assessment; for financial firms, your written information security program.
Access the provider will request
| Access | Why it is needed | Safeguard |
|---|---|---|
| Microsoft 365 or Google admin | Manage users, mail, security settings | Create a named admin account for the provider with multi-factor authentication; do not share your own |
| Domain registrar and DNS | Control email delivery and website records | Keep the registrar account in your company's name |
| Firewall and network devices | Monitoring, updates, configuration | Individual accounts with logging |
| Servers and hypervisors | Patching, monitoring | Provider-managed privileged accounts that are vaulted |
| Backup console | Verify jobs and restores | Read access first, then management access as needed |
| Line-of-business apps | Support and integration | Limited accounts, vendor coordination |
| Vendor portals (internet, phone, software) | Open tickets on your behalf | Written authorization letter |
How to hand over credentials safely
- Never email passwords. Use the provider's secure method, such as an encrypted password manager or a one-time secure link.
- Create dedicated administrator accounts for the provider instead of sharing your own login. That lets you see who did what and revoke access cleanly.
- Require multi-factor authentication on every administrative account.
- Keep break-glass access. Store at least one global administrator credential and the registrar login in a sealed or vaulted location that the company controls.
- Document who has access. Keep a list of every provider account and review it when staff or the provider changes.
- Rotate shared credentials at the end of onboarding and at contract termination.
Who inside your company should be involved
- Primary contact: day-to-day decisions and approvals.
- Backup contact: when the primary is out.
- Finance: to approve onboarding charges, license purchases and renewals.
- Department heads: to describe how teams actually use technology.
- Leadership sponsor: to resolve disagreements about spending on remediation.
What to do if you do not have the documents
Missing documentation is common in small businesses. Tell the provider early. Many will run discovery tools to build an inventory, and some include that in onboarding while others bill it separately. In the meantime:
- Collect receipts and invoices to identify licenses and equipment.
- Ask long-time employees to list the systems they use.
- Contact your internet provider and software vendors to confirm account details.
- Check the company's corporate card statements for forgotten subscriptions.
Preparing employees
Tell staff that a new provider is starting, how to contact the help desk and what to expect: installation of software agents, security prompts and possibly a password reset. Remind them that the provider will not ask for their password by email or text. If someone does, they should report it. The onboarding timeline shows where these steps fit.
A quick pre-kickoff checklist
- Inventory spreadsheet of users, devices and software.
- List of vendors with account numbers and contacts.
- Named internal contacts.
- Authorization letter for vendors.
- Dedicated provider admin accounts planned with multi-factor authentication.
- Backup information gathered.
- Compliance obligations summarized.
- Break-glass credentials secured.
The checklist tool tracks these steps.
Frequently asked questions
Do I have to give the provider full administrator access?
Typically, yes, for the tasks they perform. Limit it to named accounts, require multi-factor authentication and review the list regularly. Ask how they secure those credentials.
Should the provider create our accounts or should we?
Where possible, you create or authorize them, so ownership stays with the business. Providers can then add their own named admin accounts.
What if the provider asks to keep our passwords in their own system?
That is common, but ask how the vault is protected, who can view entries and how you get a copy if you leave. See reading an MSP service agreement for the ownership clauses to check.
Is it safe to give a provider access to regulated data?
It can be, with the right contracts and controls. For health information, HIPAA generally requires a business associate agreement; see cybersecurity and compliance.
Sources and further reading
- Cybersecurity and Infrastructure Security Agency — guidance on secure credential practices and multi-factor authentication.
- NIST — identity and access management guidance.
- U.S. Department of Health and Human Services — HIPAA business associate information.
- Federal Trade Commission — protecting personal information in business.
