Managed IT Onboarding Timeline: What to Expect in the First 90 Days

Managed IT onboarding for a small business typically takes four to twelve weeks, depending on the size and condition of your environment. The first week covers kickoff and access; weeks two to four deploy monitoring and security tools and document what you have; the following weeks fix the most urgent risks; and by about day 90 you should have a first formal review, a documented environment and a roadmap. If a provider promises everything in a weekend, ask what is being skipped.

Why onboarding takes time

A new provider has to learn your environment before it can support it. That means finding every device and account, understanding how your applications fit together, installing management software and bringing systems up to a baseline. Rushing risks outages, missed systems and gaps in security. Providers vary, so treat this timeline as a representative pattern and ask for a written plan with milestones.

Phase 1: Kickoff and discovery (weeks 1 to 2)

Provider activities

• Kickoff meeting to confirm scope, contacts and communication rules.
• Collection of administrative credentials through a secure method.
• Network and device discovery scans.
• Review of existing documentation, licensing and vendor contracts.
• Initial risk assessment covering backups, patching, antivirus, user accounts and email security.

Your activities

• Name an internal point of contact and a backup.
• Provide the documents and access listed in documents and access needed.
• Introduce the provider to key vendors, such as your internet provider and software suppliers, and authorize them to speak on your behalf.

Phase 2: Tooling and documentation (weeks 2 to 4)

Provider activities

• Install remote monitoring and management agents and endpoint security on devices.
• Configure alerting and patch schedules.
• Document the network, servers, cloud tenants, domains and licenses.
• Review backup coverage and run an initial restore test.
• Set up the help desk: phone number, email, portal, and the process for urgent issues.

Your activities

• Allow time for agent installs, and make sure laptops that are often offsite connect so they can be enrolled.
• Review the documentation for errors, such as former employees still listed or missing locations.
• Communicate help desk instructions to staff.

Phase 3: Remediation and hardening (weeks 4 to 8)

This is where many surprises appear. The provider's assessment may identify:

• Operating systems or devices past end of support.
• Missing multi-factor authentication on email and administrator accounts.
• Backups that are not tested or that do not cover critical data.
• Shared accounts, stale accounts and excess administrator rights.
• An outdated firewall or poorly segmented network.
• Unpatched software.

Expect a prioritized list: urgent items fixed under the agreement, recommended items that may be billed as projects, and long-term items for budgeting. Ask for the list in writing with estimated costs and rationale. See what affects the price for how cleanup can influence quotes.

Phase 4: Stabilize and review (weeks 8 to 12)

• First monthly or quarterly report: ticket volumes, response times, patch status, backup results, security alerts.
• A review meeting: what is working, what is not, what projects are coming.
• Tuning of alerts to reduce noise.
• Training for staff on phishing and the help desk process, if included.
• A technology roadmap and budget for the next 12 months.

Illustrative timeline table

The table is an example of the pattern. Your plan may be faster or slower.

What can slow onboarding

• Slow delivery of credentials or documents.
• Staff who do not respond to requests to install software or enroll in multi-factor authentication.
• Hidden systems no one remembers, such as an old server in a closet.
• Third-party vendors who must approve changes.
• Reaching decisions on hardware replacement.

What you can do to speed it up

1. Gather information before kickoff using the checklist tool.
2. Make decisions quickly on remediation items.
3. Give the provider authority to speak to your vendors.
4. Communicate with employees early and repeatedly.
5. Keep one person responsible for answering the provider's questions within a day.

Signs onboarding is going well

• You receive documentation you can read and verify.
• The provider asks questions about how your business operates, not only about devices.
• Issues found are explained with priorities and costs.
• Staff know where to get help.
• You see the first report on time.

Signs of trouble

• No written plan, or the plan slips repeatedly without explanation.
• Staff are told to share passwords informally.
• The provider takes control of accounts or domains and will not document them.
• Problems are described in vague terms with no priority or price.

See common mistakes to avoid if you recognize these.

Frequently asked questions

Will there be downtime during onboarding?

Usually minimal, but some changes such as replacing a firewall, migrating email or retiring a server require planned maintenance windows. Ask for them to be scheduled outside business hours.

Who pays for the cleanup work?

It depends on the contract. Some providers include baseline remediation in onboarding; others bill it as projects. Clarify before signing.

What if I disagree with a recommendation?

Ask for the risk in writing and decide. Reputable providers will document that you declined a recommendation, which also protects both parties.

When should I judge the provider?

Wait until after the first full cycle: a month of tickets, a patch cycle and a restore test. Judge on reports and responsiveness, not the first week.

Sources and further reading

• Cybersecurity and Infrastructure Security Agency — free assessments and guidance for small organizations.
• NIST — framework resources for baseline security.
• Small Business Administration — resources for planning technology projects.