5 Runbooks Every MSP Should Automate First | Junto

Written by Reed Watne | Apr 21, 2026 1:04:59 AM

Every MSP has processes that happen dozens of times a week, follow roughly the same steps, and still require a technician to do them manually from start to finish. These are your highest-ROI automation candidates — not because they’re complex, but because they’re frequent. Automating a task your team does five times a day returns more value than automating something that happens once a month, no matter how sophisticated the monthly task is.

Runbooks turn those repeatable processes into structured, AI-assisted workflows. Instead of a technician executing every step from memory (or from a doc they may or may not check), a runbook defines the steps, gathers the context, and walks the process through to completion — with the technician approving rather than performing.

Here are the five runbooks that deliver the fastest payback for most MSPs, and what each one looks like when automated.

1. Password Resets

Password resets are the single most common help desk request at most MSPs. They’re simple, well-defined, and take a disproportionate amount of time relative to their complexity — not because the reset itself is hard, but because of the verification and documentation steps around it.

The Manual Process

  1. Technician receives the ticket and reads the request.
  2. Verifies the user’s identity (checks contact info in ConnectWise, maybe calls back).
  3. Opens Active Directory or M365 admin center.
  4. Resets the password.
  5. Communicates the temporary password securely.
  6. Documents the action in ConnectWise.
  7. Closes the ticket.

That’s 7 steps for a task whose core action — resetting a password — takes about 10 seconds.

The Automated Runbook

When a ticket is classified as a password reset, the runbook:

  • Verifies the requestor against the contact record in ConnectWise
  • Identifies the correct directory service (AD, Azure AD, M365)
  • Generates a secure temporary password meeting the client’s policy requirements
  • Drafts a response to the user with secure delivery instructions
  • Prepares the ticket documentation with a timestamped action log

The technician reviews, approves the reset, and the runbook executes the remaining steps. A 5-minute process becomes a 30-second review. Across 10-15 password resets per day, that’s over an hour of technician time recovered — daily.

2. New User Onboarding

Onboarding is where documentation and execution collide. Every client has a slightly different onboarding process — different applications, different distribution groups, different license tiers, different hardware assignments. The documentation exists in ITGlue (hopefully), but finding it at the right moment is the bottleneck.

The Manual Process

  1. Technician receives the onboarding request.
  2. Searches ITGlue for the client’s onboarding SOP.
  3. Creates the M365 account with the correct license.
  4. Adds the user to the right security groups, distribution lists, and SharePoint sites.
  5. Configures line-of-business applications.
  6. Sets up the device (if applicable).
  7. Provisions phone/VoIP extension.
  8. Documents everything and notifies the client.

This process touches ConnectWise, ITGlue, M365, the RMM, and potentially the client’s phone system. A thorough onboarding takes 30-60 minutes, and an incomplete one creates follow-up tickets for weeks.

The Automated Runbook

The onboarding runbook pulls the client’s SOP from ITGlue, then walks through each step with pre-filled information:

  • User account creation with the correct license tier (pulled from the client’s license matrix)
  • Security group and distribution list assignments (from the client’s onboarding SOP)
  • Application provisioning checklist with client-specific requirements
  • Device assignment from available inventory in NinjaOne
  • Communication templates for the new user and their manager

The technician approves each stage rather than executing each step manually. The runbook handles the cross-tool orchestration — creating the account in M365, updating ConnectWise configurations, and documenting the completed steps in ITGlue — while the technician verifies that each action is correct for this specific user.

3. Device Troubleshooting

“My computer is slow” is the second most common ticket category at most MSPs, and it’s also the most variable in terms of how technicians handle it. Without a structured process, troubleshooting depends entirely on who picks up the ticket and what they think to check first.

The Manual Process

  1. Technician reads the ticket and guesses at possible causes.
  2. Opens NinjaOne to check the device — CPU, memory, disk, uptime.
  3. Checks for pending updates or failed patches.
  4. Looks at installed software for known resource hogs.
  5. Reviews event logs for errors.
  6. Maybe checks historical tickets for this device.
  7. Tries a series of fixes based on what they find.

The order and thoroughness of these steps varies wildly by technician. One tech might catch a failing disk immediately; another might spend 30 minutes on software issues before checking hardware health.

The Automated Runbook

The device troubleshooting runbook standardizes the diagnostic sequence:

  • Pulls comprehensive device data from NinjaOne (hardware health, resource utilization, uptime, patch status)
  • Checks for known issues with the device model, OS version, or installed software
  • Reviews historical tickets for this device and similar devices at the client
  • Surfaces relevant ITGlue documentation for the client’s device configurations
  • Runs diagnostic scripts via the RMM to gather additional data
  • Presents findings in priority order with recommended next steps

The technician sees a structured diagnostic report rather than starting from a blank slate. Common fixes — clearing temp files, restarting services, applying pending patches — can be approved and executed directly from the runbook. Only genuinely complex issues require manual troubleshooting.

4. User Offboarding

Offboarding is onboarding’s mirror image, and it’s arguably more important to get right. A missed step during offboarding — an account that stays active, a shared mailbox that doesn’t get reassigned, a license that keeps billing — creates security risks and unnecessary costs.

The Manual Process

  1. Technician receives the offboarding request.
  2. Searches ITGlue for the client’s offboarding SOP (if one exists).
  3. Disables the user’s AD/Azure AD account.
  4. Converts the mailbox to shared or sets up forwarding.
  5. Removes the user from security groups and distribution lists.
  6. Transfers file ownership (OneDrive, SharePoint).
  7. Revokes application licenses.
  8. Removes the device from management (or reassigns it).
  9. Updates ConnectWise configurations.
  10. Documents everything.

Miss step 7, and the client pays for a license they’re not using. Miss step 3, and a former employee still has access. Miss step 6, and critical files disappear after the account retention period expires.

The Automated Runbook

The offboarding runbook treats each step as a checklist item with pre-populated data:

  • User’s current account status, group memberships, and license assignments (from M365)
  • Active device assignments (from NinjaOne)
  • Open tickets or pending requests (from ConnectWise)
  • Client-specific offboarding requirements (from ITGlue)
  • File ownership summary and transfer recommendations

Each step requires technician approval before execution. The runbook tracks completed vs. remaining steps, ensuring nothing gets skipped even if the offboarding is interrupted. When complete, it generates a comprehensive offboarding record for compliance documentation.

5. Security Incident Response

Security incidents require speed, thoroughness, and documentation — three things that are hard to deliver under pressure without a structured process. When a Sophos alert fires, the technician needs to assess the threat, contain it, investigate the scope, and communicate with the client — all while documenting every action for potential compliance review.

The Manual Process

  1. Technician receives the alert and assesses severity.
  2. Identifies the affected device and user.
  3. Checks the threat details in Sophos.
  4. Determines if the device should be isolated.
  5. Investigates whether other devices are affected.
  6. Researches the specific threat for remediation steps.
  7. Executes remediation.
  8. Notifies the client per their incident response requirements.
  9. Documents everything for compliance.

Under the stress of an active security incident, steps get skipped. Client notification requirements get forgotten. Documentation happens after the fact — if it happens at all.

The Automated Runbook

The security incident runbook activates when a security alert is detected:

  • Pulls full threat details from Sophos including affected files, processes, and detection type
  • Identifies the device, user, and client from NinjaOne and ConnectWise
  • Surfaces the client’s incident response procedure and compliance requirements from ITGlue
  • Checks for related alerts across the client’s other devices
  • Presents containment options (isolate device, disable user account, block process) for technician approval
  • Generates the client notification using the client’s required format and communication preferences
  • Creates a timestamped incident log documenting every action taken

The technician still makes every critical decision — isolate or not, notify now or investigate further, remediate or escalate. But the runbook ensures that the information needed for those decisions is available instantly, and that every required step in the response process is tracked.

Where to Start

If you’re new to runbook automation, start with password resets. They’re the highest volume, the most straightforward, and the fastest to prove ROI. Once your team sees that a runbook can handle a 5-minute task in 30 seconds without sacrificing quality, the appetite for automating the next process follows naturally.

The order after that depends on your MSP’s specific volume and pain points. If onboarding is eating hours every week, prioritize that. If your team struggles with consistent offboarding, that’s your #2.

The common thread across all five is that the technician’s time shifts from execution to oversight. They’re still in the loop. They still approve every action. But the manual steps that consume the bulk of the process time — the lookups, the cross-tool navigation, the documentation — are handled by the runbook.

Ready to build your first runbook? Start with Junto and see the runbook documentation for step-by-step setup.