How Onboarding Works

How onboarding works.

The methodology — what happens, in what order, with what deliverables, from first conversation to run state.

/ The Phases

Three phases, in order.

01 · THE WORKING SESSION

Phase 1 — The working session

One session. You bring your org chart, your site list, and your current IT invoice. We map personas, devices, sites, and access requirements. Output: the deployment scope and its fixed quote. No discovery phase — the session is the discovery.

02 · THE DEPLOYMENT

Phase 2 — The deployment

One fixed quote, one project.

/ The deployment, step by step

The deployment, step by step.

  1. 01

    The sweep.

    The sweep runs remotely. Your people walk each site to a guided workflow, or we bring in a partner to do it. Every device is inventoried, serialized, and enrolled from our side. Surplus hardware ships back to a dedicated cage for your company at the RTP hub.

  2. 02

    The critical devices.

    Every operation-stopping device gets a configuration profile and a runbook. Spares are staged ahead of need, sized with you.

  3. 03

    Your people's devices.

    Every device type gets its own ready-made setup, built in Microsoft Intune. Fully configured spares are placed ahead of time at every site — in smart lockers, if you want self-service swap for people working on site, or in a locked equipment room. Inventory is kept current continuously, at the hub and at your sites.

  4. 04

    Access.

    From your roles and their access needs, we build the initial sign-in rules — deciding who can sign in, from which device, and under what conditions (Conditional Access) — and connect them to Global Secure Access, Microsoft's service that checks that traffic on the way to your apps. Nobody is trusted by default; every sign-in is checked on its own merits (zero trust). Rules run in a watch-only mode first, and go live after your sign-off.

Deliverables: the device list — every serial, every site · a configuration plan and instructions for each device · the spare matrix — what is staged where · a ready-made setup per role in Microsoft Intune · the sign-in rules (Conditional Access), tested in watch-only mode · the cutover plan.

All of it from templates. All of it one fixed quote. This is what an onboarding session and a templatized push means.

Smart lockers and all hardware are purchased by you; we build, stage, and maintain what goes in them.

03 · CUTOVER AND RUN

Phase 3 — Cutover and run

Policies run in report-only mode until you sign off. Enforcement is promoted, support goes live, and Your IT Department begins. The monthly account starts in month one: devices, movements, requests, and how secure things are.

/ What We Need

What we need from you

  1. 01Microsoft 365 with Entra ID and Intune, licensed in your name — including the Intune Suite add-on, or a Microsoft 365 E3 or E5 plan, which includes the same capabilities. This is what lets Your IT Department detect and fix device problems before your people report them. It is a Microsoft license on your agreement, billed by Microsoft, not a Surya charge.
  2. 02Administrative access, granted and logged.
  3. 03A named decision-maker for sign-offs.
  4. 04Hardware purchasing on your paper — devices, spares, and lockers are yours; we build and run them.
  5. 05A working machine we can copy and your list of applications — the setup starts from what your people use today.
  6. 06An HR-system trigger or forwarding for joiners and leavers.
  7. 07Your carrier account (FedEx or UPS) — freight ships on your paper.

Supported Microsoft baselines

Your IT Department runs on one of three Microsoft license baselines. We verify yours in the working session; anything missing shows up as a Microsoft line on your agreement, never a Surya charge.

Device management (Intune)

Business Premium + Intune Suite
Included
Microsoft 365 E3
Included
Microsoft 365 E5
Included

Identity and Conditional Access (Entra ID)

Business Premium + Intune Suite
P1
Microsoft 365 E3
P1
Microsoft 365 E5
P2, adds risk-based access

Device analytics and live device query

Business Premium + Intune Suite
Included via Intune Suite
Microsoft 365 E3
Included
Microsoft 365 E5
Included

Scheduled detect-and-fix scripts (Remediations)

Business Premium + Intune Suite
Covered by our automation pipeline
Microsoft 365 E3
Included
Microsoft 365 E5
Included

Remote assistance (Remote Help)

Business Premium + Intune Suite
Included via Intune Suite
Microsoft 365 E3
Included
Microsoft 365 E5
Included

Privilege management and third-party app catalog

Business Premium + Intune Suite
Included via Intune Suite
Microsoft 365 E3
Add Intune Suite
Microsoft 365 E5
Included

Threats caught on the machine (Microsoft Defender)

Business Premium + Intune Suite
Defender for Business
Microsoft 365 E3
Defender for Endpoint P1
Microsoft 365 E5
Defender for Endpoint P2
  • Business Premium is limited by Microsoft to organizations up to 300 people.
  • Mixed Microsoft accounts are fine — each managed person needs at least one baseline; that person's baseline sets their capabilities.
  • Reaching company systems without a VPN (Microsoft Entra Private Access / Internet Access) is added at onboarding on all three baselines — it is not included in any of them.
  • E3 and E5 entitlements reflect Microsoft's July 2026 suite update; older agreements pick these up at renewal. We confirm what your own accounts include in the working session.

/ The new hire's first day

The moment it all pays off.

Your HR system (HRIS) fires a joiner event. We set up a machine to your standard setup, register it for management and security (Microsoft Intune and Microsoft Entra), and kit it — optionally in your branded packaging — before the start date. The unit ships from the RTP hub, or swaps same-day from the onsite pool.

Day one, the new hire opens one box. The laptop is ready to log in. Accessories are laid out. A welcome card, your brand. No twelve-step setup, no ticket to open, no waiting on a Thursday shipment.

They feel like the company was ready for them. Kitting bills at the published per-unit rate, and the materials pass through at our cost.

Day one, one box

  • 01Laptop imaged, enrolled, ready to log in.
  • 02Accessories laid out — charger, dongles, peripherals to your spec.
  • 03Welcome card and branded packaging — your identity, not a plain brown box.
  • 04No twelve-step setup, no ticket, no Thursday shipment.

/ The end of IT consulting

The end of IT consulting.

The end of IT consulting.

IT consulting: the industry where the deliverable is a document about the work.

Discovery — six weeks to learn what you said in the first meeting.

The roadmap deck: where projects go to be admired instead of done.

A readiness assessment is an invoice for permission to begin.

“Phase 2” is consulting for never.

Change orders are how the meter keeps running after the price was agreed.

We skipped the genre. One working session. One fixed quote. Your policies running in report-only mode before an engagement letter would have cleared legal. The end of IT consulting is the work — done, at a price you saw before the first call.

The end of IT staffing.

Hiring experience doesn’t transfer the skill — the first attempt is where projects go to die.

One hire can’t answer every request, keep every machine secure, and keep spares ready at every site.

The job posting asks for ten years of everything; the candidate pool says pick two.

Your IT Department replaces the role, not a person: AI runs the service, specialists handle the exceptions, and it doesn\u2019t resign.

The end of IT support.

Tickets measure suffering, not service.

The queue exists so the meter can run.

Escalation tiers are how one problem becomes four conversations.

Ask for help. Automation resolves it. A human specialist joins remotely when it can\u2019t. Nobody logs your problem and calls it progress.

/ Start

Start with a conversation.

Send us your fleet size and your sites. We come back with a scope and a date, usually within a business day.

Find your program →Price My Fleet →Schedule a Working Session →

Onsite spare pool sized to your fleet and site count; unused stock is reconciled at true-up. Wipe standard: erased for good, certified (NIST 800-88). Every device tracked by serial number throughout.