IT Outsourcing and Service Transition

IT Onboarding: Why the First 60 Days Can Define the Next Three Years

The quality of an outsourced IT service is often determined before the service desk answers its first support call. A structured onboarding and Service Transition process gives the incoming provider the knowledge, access, tools and controls needed to support users consistently, manage security and reduce operational risk.

When organisations evaluate a new managed IT provider, the questions tend to focus on the ongoing service. How quickly will calls be answered? What cybersecurity services are included? Who will manage Microsoft 365? What reporting will be provided? What will the monthly service cost?

These are all reasonable questions. But there is a more fundamental question that is often overlooked: what has to happen before the provider is genuinely ready to deliver the service?

The contract start date and operational readiness are not necessarily the same thing. A new IT provider does not become capable of delivering a consistent, secure and proactive service simply because the contract has started. That capability has to be built. IT onboarding is where it is built.

"An IT provider cannot consistently manage an environment it has not yet discovered, documented, secured and integrated into its operating systems."

For organisations familiar with ITIL, much of what is commonly called onboarding would be described as Service Transition. The purpose is the same: to move responsibility for live IT services into a controlled operating model without creating unacceptable disruption or risk. This article uses IT onboarding as the primary term, but references Service Transition where the ITIL context adds clarity.

Two Very Different Approaches to IT Onboarding

Model 1: Start supporting and learn gradually

  • Obtain basic credentials
  • Transfer limited documentation
  • Give users a new support number
  • Begin responding to tickets
  • Learn systems as problems arise
  • Depend heavily on engineer knowledge
  • Complete missing discovery during live service
Potential consequence: Lower initial cost, but greater uncertainty, inconsistent support and higher reliance on individual engineers.

Model 2: Structured Service Transition

  • Full discovery and audit
  • Device and infrastructure assessment
  • Security review
  • Documentation
  • Tool deployment
  • Supplier and incumbent engagement
  • Process design
  • User communication
  • Readiness assessment
  • Controlled go-live
Potential outcome: Greater initial effort, but a more repeatable, secure and scalable service.

The correct model depends on the scope of the service. A small reactive helpdesk contract may require less transition work than a comprehensive managed service covering infrastructure, security, cloud, devices, licences and governance.

Cheap Onboarding Does Not Remove the Work

If discovery, documentation and system setup are not completed during onboarding, the work is usually performed later while users are already depending on the new provider. This creates a service that is learning about the environment through the incidents it is being asked to resolve.

Engineers asking the client for information during incidents
Longer diagnosis times
Repeated explanations across different engineers
Undocumented dependencies causing unexpected outages
Delayed changes due to missing access
Security controls being deployed late
Unknown devices outside monitoring
Incomplete licence records
Unclear supplier responsibilities
Risks only discovered during an outage

The cost may move, rather than disappear

The customer may avoid a visible onboarding charge but later pay through management time, slower support, disruption, security exposure and project delays. The important question is not how cheaply responsibility can be transferred. It is whether the incoming provider will have the knowledge, access, systems, processes and controls required to deliver the promised service.

Why ITIL Practitioners Call Onboarding"Service Transition"

Onboarding can sound administrative, as though the process consists mainly of forms, introductions and account creation. Service Transition is a more accurate description because responsibility for live services is being transferred into a new operating model. The transition should cover people, processes, technology, suppliers, knowledge, security, support history, service responsibilities, escalation, governance and operational readiness.

A contract can transfer responsibility overnight. Operational knowledge cannot.

Contracts can begin on a specified date, but the incoming provider still needs accurate knowledge, system access, tooling and support procedures before it can carry that responsibility safely. Service Transition is the structured process that closes the gap between contractual responsibility and operational readiness.

A Successful Transition Requires Structured Engagement with the Incumbent IT Provider

The outgoing provider often controls essential knowledge, system access, documentation and management tools. The transition should not depend on informal email exchanges between engineers. It should be planned, tracked and governed.

The Incumbent Provider Handover Checklist

Open Incidents and Service Requests

  • Open support incidents with current status and business impact
  • Outstanding service requests and active problem records
  • Known recurring issues and pending changes
  • Unresolved supplier cases and security incidents still under investigation
  • Projects still in progress and users awaiting equipment

Documentation and Knowledge Transfer

  • Network diagrams, server inventories and cloud architecture
  • Microsoft 365 and Azure configuration
  • Firewall and internet circuit details
  • Backup configuration and recovery procedures
  • New starter and leaver processes, standard operating procedures
  • Supplier contacts, licence details and warranty information

Credentials and Privileged Access

  • Administrative and service accounts
  • Microsoft 365 and Azure roles
  • Firewall, backup and security system access
  • DNS, domain registrars and telecoms portals
  • SaaS administration and vendor support portals

Supplier and Contract Handover

  • Broadband, telecoms and cloud agreements
  • Software subscriptions and hardware maintenance
  • Domains, certificates and backup services
  • Renewal dates, notice periods and minimum commitments
  • Account ownership and named supplier contacts

Current Projects and Planned Changes

  • Infrastructure upgrades, office moves and cloud migrations
  • Security projects and device refreshes
  • Application replacements and network changes
  • Licence renewals, compliance activity and merger or acquisition work

Removing the old provider's tools before the new controls are operational can create a period in which devices are neither monitored nor properly protected.

Removal and replacement should be sequenced carefully, with clear ownership and rollback plans. Replacement controls should be deployed and validated before incumbent tools are removed.

Incumbent Tool Transition: Five Stages

01
Identify
  • Incumbent tools
  • Device coverage
  • Policies
  • Dependencies
  • Removal method
02
Deploy Replacements
  • New management agent
  • New endpoint security
  • New patching
  • New backup monitoring
  • New remote support
03
Validate
  • Device check-in
  • Security status
  • Monitoring
  • Alerts
  • Reporting
04
Remove Incumbent Tools
  • Scheduled uninstall
  • Credential removal
  • Access revocation
  • Exception handling
  • Confirmation report
05
Confirm Readiness
  • All devices accounted for
  • No duplicated controls
  • No unmanaged devices
  • Incumbent access removed
  • Risks documented

The Eight Foundations of a Successful IT Service Transition

A comprehensive IT onboarding project should establish the following eight foundations before the service goes live.

01

Users and Communications

  • How users contact support
  • Support channels and hours
  • Incident vs request guidance
  • Escalation routes
  • Self-service options
  • Security reporting
  • Launch communications and training
02

Devices and Endpoints

  • Device inventory
  • Operating systems and patch status
  • Encryption status
  • Endpoint security
  • Local admin rights
  • Warranty and ownership
  • Mobile devices and unsupported hardware
03

Infrastructure and Cloud

  • Microsoft 365 and Azure
  • Servers and virtualisation
  • Networks and firewalls
  • Wi-Fi and internet circuits
  • Identity and remote access
  • Storage and backup
  • System dependencies
04

Security and Risk

  • MFA and Conditional Access
  • Privileged access review
  • Vulnerability management
  • Endpoint protection
  • Logging and alerting
  • Former user access
  • Policy gaps and third-party access
05

Backup and Resilience

  • Protected systems and schedules
  • Retention and encryption
  • Restore testing
  • Recovery priorities and RTO
  • Disaster recovery
  • Business continuity dependencies
06

Applications, Licences and Assets

  • Application inventory
  • Licence ownership and renewal dates
  • Assigned users and unused licences
  • Hardware assets and warranties
  • Support entitlements
  • Unsupported applications
07

Suppliers and Responsibilities

  • Vendor contacts and account numbers
  • Support processes and escalation
  • Contract ownership
  • Client vs provider responsibilities
  • Third-party responsibilities
  • Charge approval
08

Processes and Governance

  • New starters and leavers
  • Access requests and change approval
  • Purchasing and escalation
  • Incident and major incident management
  • Reporting and service reviews
  • Named stakeholders

Discovery  |  Documentation  |  Access  |  Tooling  |  Communication  |  Validation

The Provider Needs More Than a Telephone Number

Modern managed IT services depend on operational platforms. Simply deploying an agent is not enough. Tools need policies, groups, exceptions, alerts, escalation routes and reporting before they can support a consistent service.

Endpoint monitoring
Remote support
Patch management
Vulnerability management
Endpoint security
Device management
Asset management
Licence management
Backup monitoring
Alerting
Reporting
Software deployment

From device to managed service

Device discovered
Management agent deployed
Security controls applied
Monitoring validated
Ownership assigned
Reporting enabled
Support ready

IT Onboarding for Regulated Businesses

Regulated organisations require particular attention to cybersecurity, data protection, access control, auditability, operational resilience, incident reporting, supplier management, business continuity, record retention and policy compliance. The incoming provider should not apply a generic standard configuration without understanding the client's regulatory and contractual obligations.

Common gaps discovered during Service Transition in regulated environments

  • A policy may require MFA, but legacy accounts remain excluded
  • A leaver process may exist on paper, but accounts remain active
  • A backup policy may exist, but recovery tests have not been completed
  • An AI policy may prohibit unauthorised tools, but staff may already use them
  • A supplier management policy may exist, but no current register is maintained

"Service Transition is one of the best opportunities to compare policy with technical reality."

Why Onboarding Needs Dedicated Project Management

IT onboarding involves many participants: the incoming provider, incumbent provider, client stakeholders, end users, security teams, application owners, telecoms providers, cloud vendors, software suppliers and compliance teams. Without dedicated project management, coordination gaps create delays, missed actions and avoidable risks.

Project Manager coordinates

  • Project plan
  • Information requests
  • Incumbent engagement
  • Technical discovery
  • System access
  • Tool deployment
  • Documentation
  • Communications
  • Risks and dependencies
  • Go-live readiness

Lead Technical Consultant owns

  • Technical discovery
  • Architecture understanding
  • Security findings
  • Tooling design
  • Access validation
  • Technical decisions
  • Incumbent technical handover
  • Readiness recommendations
Example Project Status Dashboard

Overall Status

On Track

Activities Completed

14 / 22

Activities In Progress

6

Client Actions

3 outstanding

Incumbent Actions

4 outstanding

Devices Onboarded

87 / 120

Documentation Received

8 / 12 items

Access Validated

M365, Azure, Firewall

Go-Live Readiness

In assessment

The Contract Date Should Not Be the Only Go-Live Test

The provider and client should complete a formal readiness assessment before the new service becomes fully operational. Some non-critical actions may continue after go-live, but the remaining risks should be visible, understood and accepted by both parties.

Is the Service Ready to Go Live?

Users have received support instructions
Support channels are operational
Key systems are documented
Administrative access has been validated
Incoming management tools are deployed
Incumbent tools have been safely removed or scheduled for removal
Open incidents have transferred with owners assigned
Critical suppliers are documented
Escalation routes are agreed
Approvers are defined
Backup monitoring is active
Security alerts are being received
Known risks are recorded
Major outstanding actions have owners
Support documentation is available
Hypercare arrangements are agreed

What Good IT Onboarding Should Leave Behind

A successful Service Transition should leave the organisation better documented, better controlled, more secure, easier to support, less reliant on individual knowledge, clearer about supplier responsibilities, more aware of technology risks and ready for proactive service management.

Current device and asset inventory
Infrastructure documentation
Access and permissions register
Supplier register
Application inventory
Licence record
Risk register
Open incident handover
Support process documentation
Escalation matrix
Backup review
Security findings
Tool deployment status
Service readiness report
Improvement roadmap

Why Wavex Treats Onboarding as a Critical Project

Wavex does not view onboarding as a simple administrative handover. It is a structured Service Transition project designed to create the foundations for secure, consistent and proactive IT service delivery.

Dedicated Project Management

A dedicated project manager coordinates the client, Wavex technical teams, incumbent provider, suppliers, communications, risks, actions and go-live plan.

Dedicated Lead Technical Consultant

A lead technical consultant provides technical ownership, leads discovery, validates the environment, coordinates access and tooling, and oversees the technical handover from the incumbent provider.

Structured Incumbent Handover

Wavex works with the outgoing provider to obtain documentation, open incident records, access, supplier information and system knowledge. The transition plan also coordinates the safe removal of incumbent monitoring, remote access, security, patching and management software.

Risk Identification

Wavex reviews the environment to identify technical, security, operational and support risks before they affect the live service. Findings are recorded, prioritised and discussed with the client.

ISO 27001 Certified Processes

Wavex is ISO 27001 certified and applies structured information security, access control, documentation and risk management processes throughout the transition. Certification supports consistent process quality; it does not by itself guarantee client security outcomes.

Comprehensive Service Setup

The onboarding scope reflects the services Wavex will manage, including support, Microsoft 365, Azure, endpoints, patching, vulnerabilities, backup, security, licences, assets and suppliers.

User Communication and Adoption

Wavex prepares employees for the new service through communications, support guidance, presentations, surveys, training and awareness content.

Hypercare and Post-Go-Live Support

The transition continues beyond the formal launch. A hypercare period allows issues to be addressed quickly while documentation, processes and configurations are refined using real operational feedback.

"Wavex onboarding is designed not simply to transfer responsibility, but to leave the organisation better documented, better controlled and better prepared for the future."
Explore Wavex Managed IT Services

IT Onboarding and Service Transition FAQs

What is IT onboarding?+
Is IT onboarding the same as Service Transition?+
How long does IT provider onboarding take?+
Why do some IT providers offer free onboarding?+
What information should the incumbent IT provider supply?+
What happens to the incumbent provider's software?+
Who owns open tickets during the transition?+
Should the incoming provider change all administrator passwords?+
What are the risks of poor IT onboarding?+
How do you know when the new IT service is ready?+
Does onboarding end on the go-live date?+
Why choose Wavex for IT onboarding and managed services?+

Onboarding Should Not Be Judged Only by Its Upfront Cost

A weak onboarding process leaves the provider learning through live incidents. A strong Service Transition creates operational readiness before avoidable problems affect users. The best transition should not merely replace one supplier with another. It should leave the organisation better documented, better secured and easier to manage.

The most important question is not how cheaply responsibility can be transferred. It is whether the incoming provider will have the knowledge, access, systems, processes and controls required to deliver the promised service.

Changing IT provider?

Speak to Wavex about a structured IT onboarding and Service Transition process designed to reduce risk, protect users and create the foundations for a successful managed IT relationship.