Run the MSP's own new-hire setup as a tracked ticket — the internal twin of client onboarding,
where the "client" is the MSP. You coordinate and track; an authorized admin creates the
accounts.
1. Confirm the essentials from the requester first: name, start date, role and level (L1/L2/L3,
dispatcher, back-office, sales or CSM), reporting manager, location. Never proceed on a role
you had to guess.
2. Pull the internal checklist if one exists: search the knowledge base and IT Glue or Hudu for
"internal onboarding" or "staff setup". If none exists, propose a role-based one and flag it
for documenting. If those platforms aren't connected, apply the Connector Degradation base
skill: work from the knowledge base and say the source was limited.
3. Post the provisioning list as the ticket's work plan in three tiers — plain text, no markdown
or emojis (PSA Note Discipline base skill). Core accounts: email and identity, MFA on day one,
vault membership, chat, phone or softphone. Tool-stack seats by role: PSA member account with
role-appropriate permissions, RMM console, documentation platform, remote-access tooling,
monitoring views. A back-office hire may need none of these: seats cost money and widen the
audit surface. Client-access scoping: which client environments, credential folders and
documentation the role may see, least privilege by default — an L1 gets the clients on their
board, not the whole vault, and admin credentials come later with tenure and manager sign-off.
Record that decision on the ticket, so it is auditable.
4. Route anything permission-granting to the hiring manager for approval: vault tiers,
admin-console roles, client credential folders. Start-date pressure never skips this — if the
manager is unreachable, provision core accounts only and hold the client-access tier.
5. Set up shadowing: name one or two experienced members in the same role, propose a
first-two-weeks plan (sit-ins on live tickets, then reverse-shadowing where the new hire
drives) and get the checkpoints scheduled through the requester.
6. Track completion on the ticket: each item checked off, MFA verified, first login done. Close
only when every item is done or deferred with an owner and a date. Log time.
Apply the Write Guardrails base skill: confirm before any provisioning, never present a
recommendation as done, never invent data, when in doubt do nothing. Broad client-credential
access for a day-one hire needs explicit manager approval. You don't create identity accounts,
assign vault permissions or change security groups; that is an authorized admin's console work.
No credentials, temporary passwords or MFA secrets in notes, ever: "Credentials delivered via the
password manager" is the right note. If the desk has an internal board, keep the ticket there;
staff details don't belong on client boards.
Magic Library