Managed IT Client Onboarding Form Template

Every managed service provider has a discovery questionnaire, and most of them are a spreadsheet emailed round after the contract is signed. This is that questionnaire as a form: sites and headcounts, identity provider and MFA position, firewall and network vendors, the systems the business cannot trade without and the person inside the business who owns each one, what is backed up and when a restore was last actually tested, and the escalation list with phone numbers on it. Administrative access is handled as a choice of handover method — named admin accounts, delegated partner access or an agreed vault — because passwords, keys and recovery codes have no business in a web form.

Use this template

Last updated 21 August 2026

Fields in this template

Company Namerequired
Primary IT Contact — Name and Rolerequired
Primary Contact Emailrequired
Primary Contact Phonerequired
Sites and Locationsrequired
Number of Staff Accounts (users)required
Number of Managed Devices
Number of Servers (physical or virtual)
Device Platforms in Userequired
Windows laptops and desktops · macOS · Linux workstations · iOS / iPadOS · Android · ChromeOS · Thin clients · Industrial or point-of-sale terminals · Other
Are personal devices used for work?required
No · Phones only · Phones and computers · Not officially, but it happens · Not sure
Identity Providerrequired
Microsoft Entra ID (Azure AD) · Microsoft 365 with on-premises Active Directory sync · On-premises Active Directory only · Google Workspace · Okta · JumpCloud · Local accounts only, no central directory · Other · Not sure
Is multi-factor authentication enforced for all staff?required
Yes, for all users · Admin accounts and some applications only · Available but not enforced · No · Not sure
Firewall Vendor and Model
Switching and Wi-Fi Vendor
Internet Circuits and Providers
Remote Access Methodrequired
VPN · Zero-trust or SASE service · Remote desktop gateway or terminal services · Third-party remote support tool · Cloud applications only, no remote access to the network · None · Not sure
How will administrative access be handed over?required
Named admin accounts created for our engineers inside each system · Delegated partner or tenant access (for example GDAP or an MSP portal) · Secrets shared into an agreed password manager vault · In person at the onboarding session · To be agreed at the onboarding session
Business-Critical Systems and Who Owns Themrequired
Longest Outage the Business Can Tolerate in Working Hoursrequired
Under an hour · One to four hours · The rest of the working day · One to two days · Varies by system — see notes
Existing Support and Vendor Contracts
What Is Backed Up Today?required
Servers and virtual machines · Laptops and desktops · Microsoft 365 or Google Workspace data · Line-of-business application databases · Network device configurations · Website and public-facing systems · Nothing formal · Not sure
Backup Product or Service in Use
Where are backups kept?required
On-site only · Cloud only · On-site and cloud · On-site and rotated off-site media · Not sure
When was a restore last tested?required
Within the last month · Within the last three months · Within the last year · Over a year ago · Never · Not sure
Date of the Last Tested Restore
Escalation Contactsrequired
Out-of-Hours Expectationsrequired
Business hours only · Business hours, with emergency-only cover outside them · Extended hours, for example 7am to 7pm · 24/7 for critical systems only · 24/7 for everything · To be agreed
Business Hoursrequired
Who may raise a support ticket?required
Anyone in the business · Named contacts only · Anyone, but only named contacts may approve chargeable work · To be agreed
Spend Limit for Ad-Hoc Work Without Prior Approval
Obligations Your Business Is Under
GDPR or UK GDPR · PCI DSS · HIPAA · Cyber Essentials or Cyber Essentials Plus · ISO 27001 · SOC 2 · Sector regulator requirements · Security requirements written into customer contracts · None that we are aware of · Not sure
Data That Needs Special Handling
Where must your data stay?required
No restriction · Must stay in the EU or EEA · Must stay in the UK · Must stay in a specific country — named below · Not sure
If data must stay in a named country, which one?
Anything Else We Should Know Before Day One
Completed By (name and role)required
Confirmationrequired
The details above are accurate to the best of my knowledge, and I understand that no passwords, keys or recovery codes should be entered into this form.

Who uses this template

Managed service providers onboarding a new clientIT support companies taking over from an incumbent providerVirtual CIO and IT consultancy practices running a discovery phaseCybersecurity providers scoping an environment before a first assessmentIn-house IT teams inheriting a newly acquired companyBreak-fix providers moving a client onto a contracted service

About this template

A managed IT onboarding form is a discovery instrument, and it is the only chance to ask a client questions while they are still motivated to answer them. Two weeks in, the same questions read as excuses. The category already contains forms for the day-to-day of IT service delivery — asset requests, software access requests, remote access requests, incident reports, new-employee setup — but all of those are raised by an employee inside a company that already has IT support. This one is aimed at the client company as a whole, at the moment a provider takes it on, and the respondent is usually a director rather than an engineer.

The fields are ordered the way a discovery call goes. Sites first, including home workers, because they are a location for support purposes even though nobody counts them. Then users and devices, with a note asking for the honest number including dormant accounts, because the gap between the tidy figure and the real one is usually the first thing the provider fixes. Then identity, which is the single answer that determines most of the onboarding plan, and the MFA position, which determines the first security conversation. Then the network, then the systems the business cannot trade without — captured with their internal owner, because when a line-of-business application fails the vendor will only speak to the named account holder and finding out who that is during an outage costs hours.

The backup section is deliberately blunt. It asks what is backed up, where it is kept, and when a restore was last tested, with an explicit note that never and not sure are normal first-week findings rather than accusations. Providers who ask this question at onboarding find the gap in week one instead of during a ransomware incident. The last section covers what the client expects: who may raise a ticket, what happens outside business hours, and who to call when something is burning. The compliance checklist records what the client is obliged to meet so the provider can work within it — ticking a box records an obligation, it does not create compliance, and nothing here is an audit.

12 form ideas you can build with this template

MSP New Client Discovery Form

The standard case: a managed service provider gathering the estate in writing before the first discovery session.

IT Provider Takeover Questionnaire

For displacing an incumbent, where notice periods, existing contracts and administrative access handover decide the start date.

Co-Managed IT Onboarding Form

Where an internal IT person stays in place, and the escalation and ticket-raising questions define the boundary between the two teams.

Multi-Site Business IT Onboarding

For clients with several offices, where the sites field, per-site business hours and circuit contracts carry most of the complexity.

Cybersecurity Assessment Scoping Form

Identity, MFA, remote access, backups and data handling as the pre-work for a first security review.

Post-Acquisition IT Integration Form

Used by an internal IT team to inventory an acquired company that arrives with its own directory, vendors and contracts.

Cloud-Only Small Business Onboarding

For clients with no servers, where identity provider, device platforms and Microsoft 365 or Google Workspace backup are the whole estate.

Manufacturing IT Onboarding Form

Where industrial terminals and a warehouse shift pattern change what business hours and an acceptable outage mean.

Professional Services IT Onboarding

For firms whose client files carry confidentiality obligations, using the special-handling and data residency questions.

Backup and Disaster Recovery Review Form

Run on its own with existing clients, to re-ask what is backed up and when a restore was last genuinely tested.

Annual IT Estate Refresh Form

Re-sent each year to catch drift in headcounts, systems, escalation contacts and vendor contract dates.

Charity and Non-Profit IT Onboarding

Where volunteers, shared devices and donated equipment complicate the user and device counts a standard questionnaire assumes.

What's included

An access-handover question that offers named admin accounts, delegated partner access or an agreed vault — and never asks for a credential

Business-critical systems captured with their internal owner, the name a vendor will demand during an outage

Recovery time asked in plain language — how long the business can be down in working hours — rather than as an RTO figure nobody outside IT uses

A last-tested-restore question, the one that separates having backups from being able to recover

Escalation contacts collected with phone numbers and decision rights, because email is unreachable during the outages that matter

Out-of-hours expectations recorded in writing before the first incident rather than after it

Compliance obligations recorded as the client's obligations, with no suggestion that a form makes anyone compliant

Free with unlimited submissions, and end-to-end encryption can be switched on for the form before you send it

How to create a managed IT client onboarding form

1
Click "Use this template" to start from the Managed IT Client Onboarding Form in formformform.
2
Trim the identity provider and platform lists to the environments you actually support, and add the ones you specialise in.
3
Edit the compliance checklist to the frameworks your market lives under, and delete any that never come up.
4
Set your own spend limit wording and currency in the ad-hoc work field, or delete the field if your agreement covers it.
5
Add branching in the editor after cloning if you want the backup detail to appear only when something is backed up — the template ships flat because seeded templates cannot carry conditional logic, but the editor supports it.
6
Add an Upload field in the editor if you want network diagrams or asset exports attached to the submission.
7
Turn on end-to-end encryption for the form in your account before you send it — it is per form, opt-in, and it locks once the first response arrives.
8
Send the link with the signed agreement, and book the discovery session for after the form comes back so the session is spent on the gaps rather than the basics.

Best practices for your managed IT client onboarding form

Send it before the discovery session, not instead of it. The form removes the easy questions so the session can be spent on the answers that were vague or alarming.

Never accept a password, even when a client offers one. Ask for a named admin account per engineer, or delegated partner access

both can be revoked on the day either company loses a person, and a shared administrator login makes every audit trail meaningless.

Treat 'not sure' as useful data. On identity, MFA and backups it tells you where the first week goes, and a client who feels safe answering honestly gives you a better estimate than one who guesses.

Ask the business, not the IT contact, how long an outage can last. The two answers differ, and the business's answer is the one you will be judged against.

Insist on phone numbers in the escalation list. During the incidents that need escalating, email is exactly what is unavailable.

Get the out-of-hours answer in writing before the first Friday night. Everything ticked here should match the service agreement, not what was said on the sales call.

Capture contract end dates for circuits and vendor support while the client is still enthusiastic. They are the hardest facts to find later and the easiest to let auto-renew.

Ask about personal devices and expect an uncomfortable answer. Not officially, but it happens is the true answer at most small companies, and it changes the mobile device management plan.

Book the first restore test during onboarding, whatever the client answered. A tested restore in the first month is the most valuable thing a new provider can deliver.

Re-run the form annually. Sites, systems, headcounts and escalation contacts drift, and a stale onboarding record is worse than none because people trust it.

Frequently asked questions

Why does the form not ask for admin credentials?

Because a credential submitted through a form ends up in an inbox, a database and a backup. The form asks which handover method you will use — named admin accounts, delegated partner access, or an agreed password manager vault — and the secrets travel by that method. Named accounts per engineer are the option worth pushing for, because they can be revoked cleanly.

Can I attach a network diagram or an asset export?

Yes. Add an Upload field in the editor after cloning. formformform supports file uploads of up to 2 MB per file, and encrypts them on forms where end-to-end encryption is switched on. The template ships without one because seeded templates cannot include an upload field.

Can I hide the backup detail when a client backs nothing up?

Yes, after cloning. The editor supports conditional logic; the template generator does not, so every template arrives flat and you add the rules in the editor.

Does ticking HIPAA or SOC 2 on this form mean anything?

It records an obligation your client is under so that you can work within it. It does not make anyone compliant, and this form is not an audit. formformform itself is GDPR-compliant and EU-hosted; SOC 2 and ISO 27001 certifications belong to the hosting provider rather than to formformform.

Is this form suitable for an internal IT team rather than a provider?

Yes, with light editing. It works well for a team inheriting a newly acquired company, where the acquired business is effectively a new client with its own identity provider, contracts and escalation contacts.

How long does it take a client to complete?

Twenty minutes for a client who knows their estate, and rather longer for one who does not — which is itself the finding. Sending it a week before the discovery session gives the contact time to ask colleagues about the systems they do not own.

Does the spend limit field charge anything?

No. formformform has no payment field of any kind. The field records the limit you have agreed so an engineer does not wait for a purchase decision during an outage; billing happens in your own systems.