> ## Documentation Index
> Fetch the complete documentation index at: https://docs.getthread.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Tenant Onboarding Checklist

> Onboard a new Microsoft 365 tenant: GDAP scoping, break-glass accounts, security-defaults-vs-CA decision, admin and licensing inventory.

<Info>
  **Category:** Microsoft 365 Administration · [View source ↗](https://github.com/Thread-Magic/super-magic-skills/blob/main/skills/m365-administration/tenant-onboarding-checklist/SKILL.md)
</Info>

**Runs as:** <span className="thread-chips" data-skill-tier="skill"><span className="thread-chip thread-chip-tier-skill">Skill</span></span> — you run it in Super Magic and confirm each write; there's no Flow trigger for this one.

**Connectors:** <span className="thread-chips"><span className="thread-chip">IT Glue</span><span className="thread-chip">Hudu</span><span className="thread-chip">Liongard</span></span>

**Role:** [Service & Ops Manager](/start-here/roles/service-ops-manager), [Security & Compliance Owner](/start-here/roles/security-compliance-owner)

**Outcome:** Risk & Compliance, Fewer Escalations & Less Noise

**When to use:** "We just signed \<client> — get their M365 tenant under management," standing up a brand-new tenant, inheriting a tenant from another MSP ("takeover" onboarding — the checklist doubles as the trust-nothing audit), or retro-fitting the standard onto a tenant onboarded informally. The first weeks with a new tenant decide whether it becomes a documented, recoverable environment or a mystery box — this skill turns onboarding into a fixed checklist (access, safety rails, baseline decisions, inventory, documentation) with each item a tracked ticket, not a memory.

**Run it:** as a whole-tenant onboarding pass — you prepare the checklist and compile inventories, technicians execute all tenant changes (not a Flow: no schedule trigger, and changes need a human at the console).

## Prompt

```
You prepare and compile; technicians execute every tenant change. Apply the Write Guardrails base skill — never invent data, and when in doubt about
authorization or standing third-party access, do nothing and escalate.

1. Access — GDAP first, least-privilege roles mapped to MSP security groups, not Global
   Admin for everyone (gdap-relationship-review owns the role standard and expiry). No
   shared "admin@" credentials, no standing GA accounts for convenience.

2. Safety rails before any policy work — two break-glass accounts per
   break-glass-account-audit: cloud-only, phishing-resistant or sealed credentials, excluded
   from CA, sign-in alerting, quarterly test. They exist BEFORE step 3, no exceptions, so
   nothing done later can lock everyone out.

3. Baseline — security defaults vs Conditional Access. Run security-defaults-vs-ca: licensing, exception needs and maintenance capacity decide it.
   Record the decision, rationale and a named approver. If CA, build the baseline with a
   report-only soak per conditional-access-review; if defaults, verify they are on.

4. Inventory — trust nothing, count everything. All dated and labelled point-in-time:
   - Admin-role holders (global-admin-audit). Takeover tenants routinely still carry the
     previous MSP's accounts — offboarding line items with a deadline.
   - Users, licenses assigned versus purchased, obvious waste.
   - Guests (guest-access-audit), devices and management state, MFA method quality
     (mfa-methods-audit).
   - Existing CA policies, mail rules, third-party app consents worth flagging.
   - Legacy authentication: blocked or not, and does anything still use it? Sign-in-log
     evidence, window stated. Live traffic is a remediation ticket with named dependencies,
     never a same-day block.
   Where a Liongard M365/Entra inspector exists, confirm it last ran and state the dataprint
   age; otherwise the tech takes console exports (Connector Degradation base skill: name the
   missing integration and carry on). Apply Sweep Honesty — "at least
   N", plus what you could not check.

5. Documentation. Tenant details, GDAP scope and expiry, break-glass procedure (where the
   credentials live, never the credentials), the baseline decision, the inventories, and
   deviations from the standard with reasons. Flag the gap if nothing is connected.

6. Ticketize. Each checklist item is a ticket with an owner; remediations found above get
   their own. On a takeover, removing the previous MSP's access is approval-gated
   with the client and scheduled — never silently skipped: standing third-party admin access
   is the top takeover risk. Schedule the quarterly break-glass test, CA review, guest audit
   and GDAP expiry check. Close with a summary note — items done, open remediations,
   decisions and approvers (PSA Note Discipline base skill: plain text, no markdown or
   emojis).
```


## Related topics

- [New Hire Onboarding](/skill-library/onboarding-and-access/new-hire-onboarding.md)
- [Client Onboarding Runbook](/skill-library/client-lifecycle/client-onboarding-runbook.md)
- [Internal IT Onboarding](/skill-library/msp-business-operations/internal-it-onboarding.md)