MSP onboarding process: Day-by-day first 14 days

You just won a client with hundreds of endpoints and now the panic question hits: how do you take a cold fleet and make it supportable, secure, and measurable inside two weeks? This day‑by‑day MSP onboarding process turns that panic into a predictable sprint you can staff, script, and report on.

What this plan delivers

This guide gives a runnable sequence for days 0–14: the exact checks, simple automation snippets, where to harden certificates and access, what to test, and which KPIs to watch. It's written for MSPs who already use remote‑access tools (TeamViewer/AnyDesk/RDP experience assumed) and want a repeatable playbook to avoid noisy on‑call, missed SLAs, and onboarding churn.

Prerequisites to finish before day 0

• Account and billing: confirm client tenant, contact, and billing cadence. If you'll use a managed relay, create the tenant and invite the client admin.
• Tooling: choose agent builds and packaging. If you plan mass MSI deployment, prepare the MSI and test installation on a VM (How to deploy remote desktop MSI).
• Credentials and secrets: create short‑lived enrollment tokens, service accounts, and an entry in your credential vault. Do NOT use spreadsheets — use a credential manager.
• Policy templates: baseline firewall rules, SSO/2FA requirements, and a tag naming scheme (by location, OS, owner).
• Ticket integration: map ticket queues, SLAs, escalation list, and API keys for ticketing. Aim to test this on day 3 (see ticket workflow planning).

Day‑by‑day checklist: days 0–14

1. Day 0 — Kickoff & scope confirmation: Confirm inventory (exact device count by OS), critical services, maintenance windows, and any compliance rules that force self‑hosting. If the client demands on‑prem infrastructure or data residency, plan self‑hosting; otherwise default to a managed relay.
2. Day 1 — Pilot group install (10–20 devices): Pick 10–20 representative machines (Windows, macOS, Linux, remote offices). Install agents manually or with a small MSI push, verify agent heartbeats, and confirm software version (example: agent v2.4.1). Document failures and common blockers.
3. Day 2 — Secure baseline: Enforce device certificates and SSO where available; confirm TLS per‑device certificate issuance. Remember: direct peer connections are end‑to‑end between devices; when traffic uses a relay, TLS terminates at the relay, so whoever operates it can see session traffic. Harden admin accounts and enable TOTP where supported.
4. Day 3 — Ticket and escalation integration: Connect your ticketing system and test the full flow: ticket → remote session → session note and closure. Use a staging queue and simulate a P1 incident. See Remote Support Ticket Workflow for checklist items.
5. Day 4 — Unattended access configuration: Configure unattended access policies (passwords, approval windows, device tags). Deploy and test unattended sessions for the pilot machines. If you plan fleet unattended access, follow the scale guidance in Unattended Access Fleet Deployment.
6. Day 5 — Patch and automation runbook: Run your patching job against pilot devices (OS updates, AV updates). Verify automation scripts that reboot and report status. Rollback plan: how to quickly exclude devices from the next job.
7. Day 6 — Certificate and network validation: Verify device certificates, check expiry rotation, and test connections from different public networks (home, mobile hotspot). Log any firewall or proxy rules that block relay/peer ports and document workarounds.
8. Day 7 — Monitoring and alerting: Hook agents to monitoring/metrics (uptime, last seen, agent version), set alert thresholds (e.g., agent not seen for 6 hours), and create a daily health report template for the client.
9. Day 8 — Scale install wave 1 (25–50% of fleet): Push the agent to a larger cohort using your deployment tool (GPO, Intune, RMM). Use rolling waves and watch for install failures. Capture common failure causes in a runbook.
10. Day 9 — Regression & UX checks: Confirm remote control sessions work across OS upgrades, display resolutions, and multi‑monitor setups. Test clipboard, printer redirection, and audio where used in workflows (developers, designers).
11. Day 10 — Security hardening pass: Audit remote‑access permissions, remove local admin where unnecessary, enable per‑session user approval for sensitive machines, and test MFA for admin logins.
12. Day 11 — Scale install wave 2 (remaining devices): Complete the rollout. Monitor for exceptions: non‑compliant OS builds, decommissioned devices, or devices needing onsite access.
13. Day 12 — SLA verification & reporting: Run simulated incidents and measure time‑to‑connect, first contact resolution, and session success rate. Produce the first client health snapshot: device coverage, patch compliance %, and avg time to remediation.
14. Day 13 — Documentation & handoff: Deliver runbooks, run a joint admin walkthrough, and confirm roles: who escalates, who has cert access, and who rotates keys. Ensure credential vault entries are provisioned and reviewed.
15. Day 14 — Review and optimization sprint: Triage all leftover issues, set the monthly maintenance schedule, and adjust monitoring thresholds. Freeze the onboarding checklist and convert it into an automated pipeline for the next client.

Sample commands and lightweight automation

msiexec /i tenvo-agent.msi /qn /norestart /l*v C:\temp\tenvo-install.log

# Example PowerShell enrollment (replace placeholders)
$token = "ENROLL_TOKEN"
Start-Process -FilePath "C:\Program Files\Tenvo\agent.exe" -ArgumentList "--enroll $token --tags 'site:NYC,role:workstation'" -NoNewWindow -Wait

Managed relay vs self‑hosting: the honest tradeoffs

Default recommendation: use Tenvo's multi‑region managed relay. It removes the operational burden of certificate rotation, patching the relay, scaling for NAT traversal, and multi‑region failover. Pricing tiers are Free $0 / Lite $2.99/mo / Pro $7.99/mo per seat; for an MSP the managed relay usually costs less when you factor on‑call, patching, key custody, and single‑region failover into the TCO.

When to self‑host: only if the client has a written requirement that forbids third‑party infrastructure (regulatory data‑residency, an isolated air‑gapped network, or a contractual ban on external relays). Self‑hosting is valid in those cases but not the default: you inherit uptime, TLS certificate renewal, logging, and scaling as long‑tail operational responsibilities.

Security note you must record in your playbook: Tenvo uses TLS with a per‑device certificate. A direct peer‑to‑peer connection is end‑to‑end between the endpoints; when traffic falls back to a relay, TLS terminates at that relay, so the relay operator can access session traffic. Plan audits and access controls accordingly.

Automation, policies and KPIs to track after onboarding

• Automations: automated installs with retries (3 attempts), automatic tagging, and auto‑recovery scripts for failed agents.
• Policies: certificate rotation schedule, enforced MFA for console access, and least privilege for unattended sessions.
• KPIs: device coverage (% agents installed), patch compliance (% up to date), mean time to remote connect (target <10 minutes for P1), first‑contact resolution rate (%).
• Runbook items: how to revoke keys, how to remove a device from the managed relay, and an incident play for a compromised agent.

Common failure modes and quick fixes

• Agent not installing: check AV blocks, group policy restrictions, and missing MSVC runtimes; capture exit codes from msiexec logs.
• Relay fails in a region: verify outbound TLS to the relay endpoint on port 443 is allowed; test with curl/wget from a client network.
• Unattended access prompts for approval: check the device policy and local consent settings; if necessary, update the policy and trigger a policy refresh.

Stabilize and convert to operations

At the end of day 14 you should have a documented baseline, automation for installs and patching, ticket hooks, and a monitoring dashboard that shows coverage and health. Convert the onboarding checklist into a repeatable pipeline: scripted installs, canned policy attaches, and a templated report the client receives at day 14 and monthly afterwards.

If you need a full deployment template or scripted MSI examples, bookmark the deployment guide and the fleet unattended access playbook we linked earlier — they close the gap between theory and a zero‑touch rollout.

Ready to run this on a client fleet? Download the agent, test the MSI in a VM, and start your day‑by‑day run on the next client kickoff — download Tenvo.