← All Blogs

What an MSP onboarding fee should buy you

By Best IT MSP Editorial Team - Updated October 22, 2026 - 12 min read

The Best IT MSP editorial team maintains this directory's provider data across the US and Canada. We rank providers on verified rating and firmographic data, label paid placement, and do not sell IT services.

What should an MSP onboarding fee buy you?

An MSP onboarding fee should buy five work packages and one set of deliverables you keep. The five are discovery and asset inventory, network documentation, access and credential transfer, monitoring and backup agent deployment, and a security baseline. The deliverables are the dated proof each one happened.

Most order forms show none of that. The fee sits on one line, often worth one to three months of your monthly charge, labelled onboarding or transition, with no scope beside it. You sign because the alternative is not starting. Then the work happens somewhere you cannot see, and you never find out what you bought.

Two very different kinds of work hide inside that one number, and separating them is the whole job. Some of it creates something durable that stays yours, such as a dated asset inventory, a network diagram, and a privileged account register. The rest configures the provider's own platform, such as importing your sites into their monitoring tool and building your ticket templates. The first is an asset. The second is their cost of sale, and you should not pay for it twice.

This guide is about the fee and its deliverable. For the move itself, read Switching MSPs: The Transition Playbook. For the clauses around the fee, read MSP Contract Red Flags, and for judging the paperwork you get back, read What Good IT Documentation Looks Like.

The five jobs a provider finishes before it can support you

To support an estate, a provider learns it first, and that learning is the five jobs below. Each one produces something you can hold, which is why each one can be priced, dated and checked.

• Discovery and asset inventory. Every device, server, cloud tenant, network appliance and license, counted rather than copied from the last provider's spreadsheet.
• Network documentation. A current diagram of circuits, firewalls, segments and sites, drawn from what discovery actually found.
• Access and credential transfer. Named administrator accounts for their staff, a break-glass account held by you, and every shared password retired. A provider has to transfer control, not borrow it.
• Monitoring and backup agent deployment. Agents deployed, reporting, and reconciled one by one against the inventory count.
• Security baseline. A first measurement of patch state, multi-factor authentication coverage and log retention, written down as numbers on a date.

Public guidance treats three of those five as permanent duties rather than project work. CISA asks organizations to maintain a regularly updated inventory of all organizational assets, naming those assets as data, hardware, software, systems, facilities and personnel, and to keep accurate documentation describing current network topology, with network reviews performed and tracked on an annual basis. The Center for Internet Security puts the same thing first in its control set, asking you to actively manage, meaning inventory, track and correct, all enterprise assets, and names the purpose as finding unauthorized and unmanaged assets. So onboarding invents no new requirement. It does, for the first time, the thing you were already supposed to be doing.

Counting is harder than it sounds, and the most honest evidence comes from a government watchdog. The Government Accountability Office's own inspector general found that the agency inventoried less than 20 percent, 1,035, of the 5,374 IT assets reviewed in fiscal 2021, and that 41 classified IT items carried no inventory date at all. That is an organization with a mandate, a budget, and auditors down the hall. A fifty-person firm that has never been inventoried is not going to be easier.

The security baseline earns its place because of what providers keep finding. Sophos, reviewing 661 incident response cases handled between November 2024 and October 2025, reported a lack of MFA in 59 percent of cases and found that missing logs due to data retention issues doubled over last year, largely on firewall appliances where the default was only seven days, and in some cases, 24 hours. Those are precisely the findings a baseline surfaces in week one, and precisely the ones nobody records when nobody is paid to look.

Does any standard say what onboarding must produce?

No published standard prescribes a deliverable list for MSP onboarding. No clause defines a service transition for a managed IT contract, no certification checks one, and no regulator sets the outputs. That absence matters, because it means the deliverable list is yours to write or it is nobody's.

Two useful things do exist. The first is how the largest IT buyer in the world handles transition. Under the standard federal continuity of services clause, a contractor must, on the contracting officer's written notice, furnish phase-in, phase-out services for up to 90 days after this contract expires and negotiate in good faith a plan with a successor which shall specify a training program and a date for transferring responsibilities for each division of work and is subject to the contracting officer's approval. The contractor is reimbursed for all reasonable phase-in, phase-out costs plus a fee (profit) not to exceed a pro rata portion of the fee (profit) under this contract. Read that last part twice, because it is the pro rata share of the PROFIT rather than of the contract value. Transition is a bounded, separately paid phase with an approved transition plan, and the buyer approves the plan before the money moves.

The second is the control frameworks quoted above, which require the artifacts whether or not a transition is happening. Put the two together and you get the standard nobody wrote down. Onboarding is a paid project, with a plan you approve, that produces the asset inventory and the documentation the frameworks already expect you to hold.

Waiting for a formal standard is not a plan. NIST's dedicated guide to buying IT security services dates from October 2003 and frames the work as a life cycle rather than a schedule of outputs. Twenty-three years on, there is still no published deliverable list for this kind of purchase.

Four tests that prove the onboarding actually happened

Four tests prove it, and all four run on verifiable paperwork you already hold. A count that reconciles, a date on every document, a person named rather than a company, and a file you can open without the provider's platform. Run them 30 days after the fee is paid.

• The count reconciles. Ask how many monitored endpoints the agents report, then compare that number to the line count in the asset inventory. The two match, or the gap is listed and explained.
• Every document carries a date and a version. An undated diagram cannot be shown to have been redrawn rather than inherited.
• A person is named, not a company. The register of administrator accounts names individual technicians, because CISA tells customers to ensure contractual agreements specify that MSPs will not reuse admin credentials across multiple customers.
• The file opens without their software. You can export the inventory as a spreadsheet and the diagram as a PDF, today, without asking permission.

The fourth test decides whether you bought an asset at all. A perfect inventory that exists only inside a provider's platform is a feature of their service, not a deliverable of yours. If it cannot leave, you paid to build their switching cost.

Make the tests enforceable by withholding part of the fee. Split it, and pay the balance against acceptance criteria that name the artifacts. CISA warns customers that disabling MSP accounts can be overlooked when a contract terminates, which is the same failure in reverse, work nobody verified at a moment nobody was watching. Put the milestone in the order form rather than the service level agreement, because the fee is a project and the service level agreement governs the months after it. A provider doing real onboarding accepts a milestone, because the work is real and the dates are theirs to hit.

An inventory that cannot leave the provider's platform is not a deliverable. It is a feature of their service that you paid to install.

Turn the fee into hours before you sign

To test whether a fee is proportionate, divide it by a loaded hourly labor cost and read the answer as a ceiling on hours rather than an estimate. The arithmetic needs two public numbers and no cooperation from the provider.

The first number is pay. The Bureau of Labor Statistics puts the median annual wage for computer network support specialists at $76,220 in May 2025, and for computer user support specialists at $61,860. Spread over 2,080 working hours, the network figure is about $36.64 an hour of wages.

The second number is the loading on top of pay. BLS measured total employer compensation costs for private industry workers at $46.89 per hour worked in June 2026, of which wages and salaries averaged $32.82, or 70.0 percent of the total. Dividing wages by 0.70 gives the all-in cost, so $36.64 of wages costs an employer roughly $52 an hour.

Now divide. A $3,000 onboarding fee is about 57 hours at that rate, a week and a half for one engineer. That is a ceiling, and the real figure sits well below it, because the provider also carries tooling, management and margin. Read the number in both directions. A fee implying 200 hours needs a scope that explains them, and a fee implying six hours cannot contain a discovery, a diagram, an agent rollout and a baseline.

The useful part is what the arithmetic lets you say next. You stop arguing about whether a fee is fair. You ask the provider to scope each of the five jobs in writing, then ask which of them fits inside the hours the fee can pay for, and which one is being quietly dropped.

What happens to the fee if you leave in month three?

Nothing comes back. An onboarding fee is almost always one-off and non-refundable, so the money is spent the moment the work starts. What survives an early exit is the paperwork, which is the whole reason to insist the paperwork exists and that it leaves with you.

The federal rule points the same way without refunding anything. It pays transition costs and caps the profit on them at a pro rata portion of the fee (profit) under this contract, which treats transition as earned by work completed rather than by time served. The commercial equivalent is easy to ask for and rarely offered. Request that the fee be stated as a schedule of deliverables, so an early exit leaves you holding the ones already accepted.

Watch anything bought alongside the fee, because its clock is shorter than yours. Microsoft gives a prorated refund on a license-based subscription within seven calendar days of purchase, and states that the cancellation window doesn't reopen until the subscription itself renews into a new term. If your provider commits you to annual subscriptions during week one, the window to unwind that closes long before you know whether onboarding worked.

One deadline is tighter still, and no contract mentions it. Microsoft Entra ID keeps seven days of audit logs and sign-in logs on the free tier, against 30 days on P1 and P2, and states plainly that log retention changes aren't retroactive, so data that has already expired cannot be recovered unless it was archived. On day one of onboarding, your own sign-in history is a week deep. A baseline captured in week four is a baseline of week four, and the month you were curious about is gone.

That is the strongest argument for paying an onboarding fee at all, and for demanding its output on a date. The provider is not only learning your estate. It is taking the only measurement you will ever have of the estate from before it was theirs.

Three answers that mean the fee is a line item

Three answers mark a fee with no project behind it. Each one describes effort instead of output.

• We will get you set up in our systems. That describes their platform configuration, which is a cost of sale rather than a deliverable of yours.
• The documentation lives in our portal. Ask for the export. Where there is no export, there is no asset.
• It covers our time. Time is an input. Ask which of the five jobs the fee finishes, and on what date.

None of this makes a fee wrong. Taking over an estate is genuinely a project, the work is real, and a provider who charges nothing to onboard you is usually recovering it in the monthly rate or skipping it. Pay the fee. Just buy dated, exportable deliverables with it, then ask three providers what they will hand over, because that answer varies far more than the price does.

FAQ

What is an MSP onboarding fee?

An MSP onboarding fee is a one-off charge for the transition project a provider runs before it can support your systems. It covers discovery and asset inventory, network documentation, credential transfer, monitoring and backup agent deployment, and a first security baseline. CISA expects every organization to maintain a regularly updated inventory of all organizational assets in any case.

Is an MSP onboarding fee negotiable?

The amount is often fixed and the structure usually is not. Ask to split the fee against accepted deliverables instead of paying all of it up front. The federal government does something similar with its own contractors, reimbursing transition costs while capping the profit on them at a pro rata portion of the fee (profit) under this contract.

What should I receive at the end of MSP onboarding?

Expect five dated artifacts you can export. An asset inventory, a network diagram, a register of administrator accounts naming individual technicians, an agent count reconciled against the inventory, and a baseline recording patch state, MFA coverage and log retention. CISA asks for accurate documentation describing current network topology, with network reviews performed and tracked on an annual basis.

Is an MSP onboarding fee refundable if I cancel early?

Almost never. The fee pays for work already done, so the recoverable part is the paperwork rather than the money. Anything bought alongside it has its own short window. Microsoft allows a prorated refund on a license-based subscription within seven calendar days of purchase, and nothing after that until the term renews.

How do I know the onboarding work actually happened?

Run four checks 30 days in. Reconcile the monitored agent count against the inventory, confirm every document carries a date and a version, check that the account register names individual people, and export one file without the provider's help. Sophos found missing logs due to data retention issues doubled over last year, so test log retention too.

← All Blogs