← System Owner · Master

Knowledge material · ~6 min read

System Owner · Master

You can stand up a brand-new client from a blank tenant.

Overview

Master-level System Owners onboard. You take a contract on Monday and a working environment exists by Friday — firewall configured, identity wired, devices enrolled, security stack live, documentation written. Onboarding is the highest-leverage skill in an MSP (Managed Service Provider) because every shortcut you take here becomes a ticket later.

Onboarding playbook

  • ▸Day 0: discovery — users, devices, apps, network, current pain.
  • ▸Week 1: identity (AD (Active Directory)/Entra), RMM (Remote Monitoring and Management) agents, backup, AV (Antivirus)/EDR (Endpoint Detection and Response).
  • ▸Week 2: M365 (Microsoft 365) tenant hardening, firewall standardization, documentation.
  • ▸Week 3: training, handoff to service team, baseline reporting live.

Firewalls — the boundary

  • ▸Rules top-down, first match wins; explicit deny at bottom.
  • ▸Document every allow with ticket #, owner, expiry.
  • ▸VPN (Virtual Private Network): prefer SSL (Secure Sockets Layer)-VPN with MFA (Multi-Factor Authentication) over IPsec for users; site-to-site for offices.
  • ▸UTM features (IPS (Intrusion Prevention System), AV, web filter) only on with subscription + tuning.

Group Policy without the rage

  • ▸One GPO (Group Policy Object) per setting category, not one giant GPO.
  • ▸Name them: USR-Outlook-Profile, CMP-BitLocker-Enforce.
  • ▸Block inheritance is a smell; security filter instead.
  • ▸gpresult /h report.html before you blame the GPO.

The MSP security stack

  • ▸EDR (SentinelOne / Defender for Business / Huntress) — kill, isolate, replay.
  • ▸Email security (Proofpoint / Avanan / Mimecast).
  • ▸DNS (Domain Name System) filter (Cisco Umbrella / DNSFilter).
  • ▸Patch management via RMM; phishing simulation; dark-web monitoring.

Glossary

EDR
Endpoint Detection & Response — behavioral AV with telemetry.
Break-glass
Emergency admin account excluded from CA (Conditional Access), MFA-protected, vaulted.
Hardening
Removing defaults & attack surface before go-live.

Common pitfalls

Practice drills