Almost every IT company describes its onboarding the same way — “seamless” — and almost none describes it in detail. That’s a gap worth noticing, because onboarding is where a provider is at its most honest: it’s the first time their process either exists or doesn’t, and what happens in those first 90 days predicts the next three years better than anything in the sales meetings.
Here’s what the first quarter should look like, based on how Indigo IT onboards new clients — laid out so you can hold any provider to it, including us.
Before day one: discovery
Good onboarding starts before the contract does. Expect the incoming provider to audit your environment while your current arrangement is still running: what hardware and software exists, how identities and permissions are structured, where the data lives, what state the backups are honestly in, and what documentation the outgoing provider can hand over. Two outputs matter: a written picture of what’s being inherited, and a transition plan with dates. A provider who turns up on day one to “see what we’re dealing with” has already told you how organised they are.
Day one to week two: control and stability
- Access secured — Administrative credentials for every system taken over, rotated, and stored in a proper vault — every password the old provider ever held changes. This is the single most important security action of the whole transition, and it’s astonishing how often it’s skipped.
- Your team briefed — Staff told, simply: here’s how you get help now, here’s the number, here’s what happens when you call. A short welcome note beats a laminated process chart. The measure of success is that by week two nobody is asking ‘who do we call now?’.
- Tooling live — The provider’s monitoring, patching and security tooling deployed across the estate — because until their tools are watching, they’re supporting you blind.
- Backups proven — Backups verified by test restore, not by dashboard. If Indigo IT signs off a new client’s backups, it’s because we’ve restored something and checked it opens — inherited backup regimes fail that test more often than anyone would like.
Weeks two to six: the truth emerges
Expect a spike in tickets — and welcome it. Staff surface every problem they’d given up reporting to the old provider, and the new provider works through the accumulated debt: the printer that’s been temperamental for a year, the shared mailbox nobody can access, the mystery Wi-Fi dead zone. A good provider treats this as a snagging list to be cleared, tracks it visibly, and pairs it with documentation built from scratch — asset register, network map, licence inventory — rather than trusting inherited notes.
This is also when the security baseline lands: MFA enforced everywhere, admin rights reviewed and reduced, leavers’ accounts found and closed (there are nearly always some), email authentication (SPF, DKIM, DMARC) checked and fixed. None of this should require a project fee; it’s what taking responsibility for an environment means.
Days 60 to 90: from stabilised to strategic
By the end of the first quarter you should be holding three documents: an honest risk report (what was found, what’s been fixed, what remains and in what order), a 12-month roadmap with costs attached (hardware refresh, licence renewals, projects worth doing), and your first service review — ticket volumes, response performance, satisfaction scores. That first review meeting sets the rhythm for the relationship: if it doesn’t happen by day 90, it isn’t going to happen by day 900.
The roadmap is the piece most SMEs have never had, and it’s the one Indigo IT hears about most from clients a year in — because it converts IT from a stream of surprises into a plan the board can budget for.
Red flags in the first 90 days
- Security shortcuts — Credentials not rotated, or stored informally. If your new provider is casual about the keys, everything else is theatre.
- Opacity — No documentation delivered. ‘It’s all in our system’ means you’re building the same hostage situation you may have just escaped.
- The meter running — Quick wins invoiced as projects. Fixing the accumulated snagging list is onboarding, not billable change work — a provider nickel-and-diming in month one is showing you its character early.
- Nothing proactive — No review booked, no report, no roadmap. Reactive-only support has a way of announcing itself through what doesn’t arrive.
Frequently asked questions
Should onboarding cost extra?
Practices vary; what matters is transparency. Some providers charge a one-off onboarding fee that covers the audit and setup work, others absorb it into the contract. Either is legitimate when stated up front. What’s not legitimate is a surprise invoice in month two — ask the question before signing.
How much of our time will onboarding take?
Less than most managers fear: a few hours from whoever knows the business systems, sign-off on communications to staff, and attendance at the day-90 review. The technical work is the provider’s job — if they’re leaning on your team for it, that’s a preview.
When should we judge whether we chose well?
Day 90, against this article. Credentials rotated, backups test-restored, documentation in your hands, snagging list visibly shrinking, risk report and roadmap delivered, first review held. A provider that clears that bar has earned year one. One that hasn’t has told you ever
