IT Service Scope & Checklists
Content revision: 2026-10-21
https://zconnect.com/pages/it-service-scope-checklists
This reference lists service scopes. Your quote identifies the selected services and quantities; it does not mean every listed service was purchased.
Microsoft 365 Organisation Setup
1. Organisation and administrator setup
One-time organisation-wide setup for a new cloud-only Microsoft 365 tenant. Establish customer ownership and a secure administrative foundation before configuring services.
- Confirm tenant and business details, subscriptions and licence prerequisites.
- Record customer ownership, administrative contacts and named administrator roles separate from everyday accounts.
- Verify separate authorised backup billing access and customer billing ownership at handover; Global Administrator access is not the billing-role assignment.
- Record resource ownership and remove temporary implementation access after handover.
Ordinary named administrators may use custom-domain sign-ins. An admin-only account does not require an Exchange mailbox; premium security features remain subject to applicable licensing.
Handover instruction: the customer should test emergency access at least every 90 days. This one-time setup does not include recurring monitoring or testing.
2. Domain and business email
Configure the included domains and validate legitimate mail flow without disturbing unrelated DNS records.
- Verify up to 2 custom domains and required DNS records.
- Inventory legitimate senders, including website, invoicing and marketing services.
- Configure and test SPF, DKIM and DMARC against the agreed sender inventory.
- Agree the DMARC enforcement stage and document outstanding sender validation.
- Test incoming and outgoing mail while preserving unrelated DNS records.
Monitor-only DMARC does not provide enforced protection. This is initial configuration and validation; indefinite DMARC monitoring is not included.
3. Identity and email security
Agree a security baseline that fits the purchased licences and test it before wider enforcement.
- Configure the agreed MFA and Conditional Access baseline subject to licensing.
- Review legacy authentication, dependencies and documented exceptions.
- Configure available spam, malware, phishing and quarantine protections.
- Configure Safe Links and Safe Attachments where licensed, and external forwarding controls.
- Run pilot tests before organisation-wide enforcement and verify secure emergency access.
Device compliance is not enforced before separately scoped endpoint readiness. This setup does not provide a security or compliance guarantee.
4. Shared files and collaboration
Create clear internal and external collaboration boundaries with named owners.
- Configure up to 3 internal department SharePoint sites and their document libraries.
- Configure 1 separate external collaboration site.
- Set basic navigation, site names/logos and a standard page layout.
- Assign site owners and group-based permissions.
- Configure controlled external sharing and test that guests cannot access internal-only content.
Basic site configuration is included; custom intranet design is a separate service. Required site-permission groups do not consume the additional business security-group allowance. An underlying Microsoft 365 Group, site and calendar form one linked resource set and are not counted separately.
5. Shared mailboxes and calendars
Set up shared business resources with approved access and predictable booking behaviour.
- Configure 5 shared mailboxes with agreed addresses, aliases and approved delegates.
- Test sending permissions and sent-item behaviour; use delegated access without shared passwords or direct shared-mailbox sign-in.
- Configure 3 room/resource calendars, booking rules and conflict handling.
- Configure 3 department calendars and agreed access.
A shared mailbox includes its calendar. Built-in calendars are part of their linked resource set and are not counted again as separate resources.
6. Groups and licence assignment
Make business membership and licence allocation understandable and maintainable.
- Configure 5 distribution groups and 5 additional business security groups with named owners.
- Create collaboration groups as required by the included resources.
- Configure group-based licence assignment and up to 2 dynamic licence groups using agreed attributes and rules where appropriately licensed.
- Validate membership, licence assignment, assignment errors and available licences.
Groups required for site permissions or the security baseline are outside the additional business security-group allowance. Dynamic membership is not a safe, complete offboarding process; custom lifecycle automation is excluded.
7. Alerts and logs
Make available logging and agreed notifications usable at handover.
- Verify available audit and sign-in logs.
- Document actual log retention under the purchased licences.
- Route agreed available alerts to named customer contacts and test where supported.
Initial configuration only. Ongoing monitoring and incident response are separate services.
8. Operating procedures, testing and handover
Leave a documented configuration and practical administrator instructions.
- Provide instructions for users, access management and offboarding.
- Document an offboarding runbook covering access blocking, session revocation, ownership transfer and preservation review before licence removal.
- Record test results, exceptions and outstanding dependencies.
- Provide a configuration inventory and administrator walkthrough.
The runbook is included; actual employee offboarding and custom lifecycle automation are separate. Licence removal does not mean all data is immediately deleted; preservation and retention must be reviewed first.
Microsoft 365 User Onboarding
1. Confirm the user and access
- Confirm the approved name, email address, role and department.
- Confirm licence requirements, the business approver and authorised access.
- Verify that the organisation is configured and sufficient purchased licences are available.
2. Account and licence setup
- Create or verify the individual account and agreed email address and aliases.
- Populate agreed user attributes.
- Apply existing approved licensing groups or direct licences as appropriate, and verify assignment.
This is the employee’s setup, not a repeat of organisation setup. New tenant policies and dynamic membership rules are outside this service.
3. Approved collaboration access
- Add the employee to agreed existing Teams, Microsoft 365, security and distribution groups.
- Assign authorised access to existing SharePoint sites and shared mailboxes.
New departmental sites and shared-resource architecture are outside this service.
4. First sign-in and MFA registration
- Help the employee sign in and register a permitted authentication method under the existing organisation policy.
- Verify required password change and recovery registration where applicable.
The employee enters their own passwords and verification codes; these are never collected in handover documents. MFA is not bypassed and central policies are not changed.
5. Verify access
- Confirm mailbox provisioning and basic email send and receive.
- Verify browser access to licensed Microsoft 365 services and assigned shared resources.
- Confirm access stays within approved permissions using safe, agreed test data.
Verification does not include broad inspection of private data.
6. Short user handover and completion
- Explain sign-in, where to find email, Teams and shared files, and how to get help.
- Record completed setup and outstanding customer dependencies.
Basic orientation only; comprehensive application training and indefinite support are excluded.
Device Management Setup
One-time platform setup with standard company-owned enrollment, managed policies, standard app deployment and verification.
1. Scope and prerequisites
- Confirm the selected cloud-hosted platform or combination, supported OS families, standard company-owned enrollment workflows, app list, baseline controls and exclusions before delivery.
- Confirm required licences, customer-owned accounts, administrator access, network prerequisites and agreed representative pilot devices.
BYOD and kiosk/shared-device workflows are separately scoped. There is no arbitrary limit on ordinary policies needed to implement the agreed baseline.
2. Management platform setup
- Configure the selected platform, administrative roles, device groups, naming and assignment structure.
- Identify the primary management platform for each device type and reuse existing Microsoft 365 configuration to avoid duplicate work.
Do not assign competing MDM profiles to the same device.
3. Platform connections
- Apple, if selected: configure APNs and agreed Apple Business Manager, automated enrollment and Apps and Books connections using customer-controlled ownership.
- Android Enterprise, if selected: connect managed Google Play and configure the agreed ownership/enrollment mode.
- Windows Autopilot, if selected: verify supported Windows editions, licences, network access, device-registration route and Entra/Intune prerequisites.
Native connections depend on the selected platform, supported devices and licences. Custom identity, PKI or network redesign is separate. Using Intune for Windows and Jamf for Apple does not automatically include Jamf-to-Entra compliance integration or Conditional Access redesign; those require explicitly agreed separate scope.
4. Enrollment configuration
- Configure agreed profiles, restrictions, ownership rules and user setup experience.
- Document device registration, reset and previous-management removal requirements.
Standard enrollment covers supported, ready company-owned devices with existing users, access and licences: enroll into the configured platform, apply managed policies and agreed standard app deployments, and verify management/configuration. These steps are included, not separately billed device setup. Peripherals, migration, repairs and user-specific work outside this scope require separately agreed Technical Services.
5. Security, compliance and updates
- Configure agreed supported passcode, screen-lock, encryption, recovery-key handling, compliance and OS update controls.
- Coordinate compliance requirements with existing Conditional Access and reuse organisation-level security configuration.
Controls vary by platform, device scenario and licence. Organisation-level security setup is not duplicated.
6. Application deployment
- Prepare and assign the agreed app list, configurations and supported update methods.
- Record app licensing, packaging and compatibility dependencies.
A standard package is one vendor-supported app or suite deployment for one OS and deployment method using its supported installer/configuration. A suite normally installed as one package counts once; distinct Windows/Mac configurations count separately. Assigning the same package to many devices does not multiply the count. Bespoke packaging/scripts, unsupported apps and universal third-party patching are separate.
7. Pilot validation and acceptance
- Test enrollment, management check-in, policy application, app installation and relevant compliance/access behaviour on agreed representative devices.
- Record results, resolve in-scope platform setup issues, document exceptions and obtain acceptance.
Test pilots first within the total enrollment batch; pilots count toward the included 25 (single platform) or 30 (both platforms) and are not charged again as enrollments. Pilot work validates standard enrollment; other hands-on work outside this scope requires separately agreed Technical Services. Ordinary corrections needed to meet the agreed checklist are included; material new scope requires a quote and approval. Destructive tests require separate approval.
8. Documentation and handover
- Deliver the configuration record, enrollment instructions, administrator walkthrough and outstanding dependencies.
- Record customer ownership and renewal responsibilities for APNs, enrollment/app-distribution tokens and subscriptions.
- Explain preserving the existing APNs certificate and its owning account when renewing.
- Record completed platform setup and the agreed enrollment batch separately from separately agreed hands-on work, larger rollouts, migration, remediation and ongoing support.
Office Network & Wi-Fi Setup
Agreed firewall, switching and Wi-Fi configuration, testing and handover.
1. Site scope and readiness
- Agree the location, supported firewall/switch/access-point models and counts, internet connection, user/device needs, required networks and existing systems.
- Confirm customer-owned administrator access, licences, remote connectivity, physical installation readiness, an authorised on-site contact and the change window.
Confirm equipment suitability and the topology before implementation. Remote configuration requires supported equipment, connectivity and on-site assistance. Unexpected additional scope requires approval.
2. Plan and change preparation
- Record the agreed topology, addressing, VLANs, staff/guest separation, port roles and Wi-Fi names.
- Review existing configuration and preserve recoverable backups where supported.
- Agree cutover, rollback and who can restore local connectivity if remote access drops.
Complex existing-network migration is separate. Changes are not risk-free and uninterrupted cutover is not guaranteed.
3. Firewall and internet
- Configure agreed WAN, routing, DHCP/DNS and supported firewall/security settings.
- Restrict management access and unnecessary inbound exposure.
- Preserve approved existing business connectivity.
VPN and multi-WAN features are included only when expressly agreed, licensed and supported.
4. Switching and segmentation
- Apply agreed switch management, access/trunk ports, VLANs and PoE settings.
- Verify required inter-network access and guest isolation.
Remote configuration excludes new cabling, rack work and physical port installation.
5. Business and guest Wi-Fi
- Configure agreed SSIDs, supported authentication/security, network mappings and guest access controls.
- If selected, configure a basic supported guest welcome page.
- Check connectivity at agreed test points with on-site assistance.
Custom captive portal design is separate. A basic welcome page does not establish legal compliance. Whole-building coverage requires separately scoped survey/design; coverage and throughput are not guaranteed.
6. Verification and handover
- Test internet, wired/wireless connections, DHCP/DNS, allowed business access and guest separation. Test VPN/failover only where explicitly included.
- Record configuration, device/network inventory, test results, exceptions, customer ownership and renewal responsibilities.
- Provide an administrator walkthrough and secure credential handover; keep passwords out of ordinary documents.
- Configure initial alert routing only if agreed.
Recurring monitoring, support and patch administration are separate.
Technical Services by the Hour
1. Agree the request
- Define the question, problem or desired outcome; supported systems; current condition; priorities and authorised contact.
- Agree technical advice, troubleshooting, small changes or separately agreed project work outside a fixed package.
- Record what is outside this engagement.
2. Agree time and scope
- Agree estimated hours and a maximum authorised time budget before starting. Explain what can reasonably be attempted and any unknowns.
- Use one service unit to represent one hour of technical work.
- Stop and obtain approval before exceeding authorised hours or expanding the scope.
There is no automatic extra billing or assumed follow-on work. Time-based service does not guarantee a fix or completion of a project within the selected hours.
3. Access and preparation
- Confirm customer authority, necessary access and licences, plus backup, change-window and recovery prerequisites where applicable.
- Use approved least-privilege access and secure handling; keep passwords out of ordinary project notes.
- Identify third-party dependencies or costs separately before commitment.
4. Perform agreed work
- Provide advice, investigation or configuration within the approved scope. Document useful findings and changes.
- Obtain separate approval for destructive actions, material security/access changes and other consequential actions as required.
Purchasing hours is not blanket authority to delete data, grant access, buy products or make unrelated changes.
5. Verify and report
- Test relevant outcomes where feasible and document actual results, unresolved issues/dependencies and recommended next steps.
- Record actual time and tasks clearly.
- Do not charge twice for work included in another selected fixed package.
6. Handover and close
- Provide concise findings, configuration changes, results and customer follow-up actions.
- Review used versus authorised time and unfinished work; agree any further work separately.
- Remove temporary access as agreed.
Recurring support, an SLA, emergency response and future monitoring are not included. This is not unlimited support or a guaranteed fix.