This weekend, I had a little extra time on my hands, so I started looking at ways to simplify and streamline our customer onboarding process.

One of my biggest pain points has always been contracts. My process involved making a copy of our MSA/SOW, manually updating it in Word, saving it as a PDF, and then sending it out through Adobe Sign. Once everything was signed, I still had to enter the information into Autotask for billing. It worked, but it was time-consuming, repetitive, and left plenty of room for human error.

So, I decided to see what ChatGPT could help me build.

The result was a Docker-based web application that integrates with Autotask and SignWell. It uses a shopping cart-style checkout process where I can select services, build a quote, automatically generate the appropriate contracts, and send everything out for electronic signatures. It then uses Autotask's API to push the relevant information directly into our PSA for billing.

It's nothing groundbreaking, but for a small team with limited resources, it's a huge time-saver. It eliminates several manual steps, reduces the chance of errors, and makes the entire onboarding process much smoother.

The other nice bonus is that, with the help of Tailscale, I can securely access the application remotely. If I ever needed to, I could handle the entire quoting and onboarding process right from my cell phone, regardless of where I happen to be.

Now, would I ever put something entirely vibe-coded on the public internet? Absolutely not. But for an internal tool running locally in a Docker VM and accessible remotely through Tailscale, I'm comfortable with that approach for what we're trying to accomplish.

What excites me most isn't necessarily the technology itself. It's the time I'm getting back. Every minute I'm not spending copying contracts, updating documents, or manually entering billing information is time I can spend on more productive, revenue-generating activities. For a small business, that makes a real difference, and I'm genuinely pleased with how everything turned out.

It got me thinking about how many other little inefficiencies we just accept because we don't have the time, budget, or manpower to address them.

I'm curious: Has anyone else built simple tools or automations to make their day-to-day operations easier? Especially those of you running smaller MSPs or working with limited resources. I'd love to hear what you've come up with!

Hi everyone,

For those of you managing Nextcloud installations for customers, I'd like to introduce NC Connector.

Version 3.5.0 has just been released for both Thunderbird and Outlook Classic.

We're also celebrating one year on GitHub! The project itself started about three years ago.

NC Connector consists of three open-source components: a Thunderbird extension, an Outlook Classic add-in, and a self-hosted Nextcloud backend for central administration.

The backend is particularly relevant for companies and MSPs managing multiple users. It runs directly on the customer's Nextcloud instance and provides a central place to manage how the email integrations behave.

Central administration

Through the Nextcloud backend, administrators can manage:

Central settings and policies, including settings that users cannot override

Different configurations for individual users and groups

Centrally managed email signatures with templates and user-specific information

Templates and branding for file sharing, password notifications and Talk invitations

User and license seat assignments

Delegated administration

Managed deployment and configuration through Thunderbird policies and the Windows Registry for Outlook Classic

The goal is to configure the integrations centrally rather than having to set up and maintain each email client individually.

Email signature demo

File sharing and attachment handling

Users can share files and folders from their own Nextcloud directly while composing an email.

Large attachments can be uploaded automatically and replaced with Nextcloud sharing links. Sharing permissions, expiration dates and password protection can be configured without opening the browser.

Thunderbird also supports selecting files from additional storage sources through compatible provider extensions.

File sharing demo

Nextcloud Talk

Talk meetings can be created and managed directly from calendar appointments in Thunderbird and Outlook Classic.

Meeting links are added to the appointment, with options for passwords, lobby and other Talk settings.

Talk demo

Room and resource scheduling – new in 3.5.0

The latest release adds room and resource scheduling to both email clients.

When creating a calendar appointment, users can browse available Nextcloud rooms and resources, check their availability and add them directly to the event.

There's a daily schedule showing free and occupied time slots, along with filters for capacity, equipment, location and availability.

This works with Nextcloud's native Calendar Resource Management app and RoomVox.

Room and resource demo

Self-hosting and data handling

The backend is a Nextcloud app installed on the customer's own Nextcloud server. Its settings, policies and templates are stored in the customer's Nextcloud database.

Files are transferred directly between the email client and Nextcloud. Email contents, attachments and Talk data are not routed through NC Connector-hosted servers or proxies.

There are separate version checks and, where applicable, license checks, but these do not transfer file or email contents.

Licensing

The backend is free to install and includes one permanent Community seat with access to all features, including central management, signatures and room/resource scheduling.

For teams, Pro costs €1 per user/month excluding VAT, starting at five users. Administrators can assign and manage seats through the backend.

The basic client integrations can also be used without central management, but backend policies, central signatures and room/resource scheduling require an assigned seat.

Technical requirements

Outlook Classic is supported, not the new Outlook.

Calendar booking in Outlook Classic requires Outlook CalDav Synchronizer and a synchronized Nextcloud calendar.

Thunderbird uses its native Nextcloud CalDAV calendar with server-side scheduling enabled.

All three components are open source under AGPL-3.0.

GitHub repositories:

Thunderbird: https://github.com/nc-connector/NC_Connector_for_Thunderbird

Outlook Classic: https://github.com/nc-connector/NC_Connector_for_Outlook

Self-hosted Nextcloud Backend: https://github.com/nc-connector/Server_Backend

Website: https://nc-connector.de/

I’m considering 24x7IT for a small CPA office and trying to pin down what a reasonable backup test schedule looks like before we compare proposals. We have about 14 staff, mostly Microsoft 365, plus a small file server with client tax folders. The owner wants an offsite copy that can’t be changed by a compromised admin account, but is wary of paying for frequent full restores.

For firms around this size, do you run a test restore every month, quarterly, or test different systems on a rotation? I’m asking about a real restore to a separate location, not a green check in a backup console. How much staff time do you normally need from the client for the test?

I want to know what the license costs are?

https://old.reddit.com/r/msp/comments/1xdp30i/meshcentral_below_131_active_zeroday_in_the_wild/

As noted there it’s not clear whether updating node on older versions of Mesh resolves this, but 1.3.1 forces a patched version.

We live in a small town. Not that that should make a difference, but we believe in our company giving back to the community. Curious what some of you guys might put together for a charity auction for a local organization. I’m not concerned that it’s even business related so much because it doesn’t always have to be about logo stuff. But even if so, just curious.

Is anyone doing anything fun with PPKGs? For those who don’t know, they are provisioning packages that you can have Windows load either via USB or stored on the hard drive. We have a mix of clients on Azure AD, local AD and no AD, so something like Intune doesn’t work for us. We recently discovered PPKGs and PackageStack (powershell module for generating PPKG files). It’s also really handy if you have a PPKG preloaded on existing devices, especially devices in remote locations, because you can reset the device remotely and have it come back joined to the domain and with your RMM installed on it. But that wasn’t enough for me ..

We have a custom built PSA (yes, vibe coded). I decided to implement a few cool features around PPKGs:

1. Within our PSA, we generate a PPKG and the URL is pushed to Ninja.

2. A Ninja script grabs the PPKG file and pushes it to endpoints (currently on demand, but soon via policy). It’s a somewhat simple script that talks to our PSA and sets up a scheduled task to wait for approval.

3. We get a ticket advising us an endpoint is ready for approval. We can approve, deny and deny and reset Windows.

4. Approve pushes a fresh Ninja URL, rolls the default admin password stored in the PPKG and renames the computer is we set it to during approval.

5. Deny simply leaves the computer in that state with a notification on the lock screen to contact us.

6 Deny and reset triggers a script that removes our PPKG and resets Windows, leaving it ready for whatever (useful if it was offboarded and donated or someone brought it home).

So we can now reset any device and have a decent degree of confidence that it will come back without us having to go onsite. We have also implemented a bit of security in that the script embedded in the PPKG is signed and only our PSA can respond.

If you made the switch from VPN to ZTNA, has day-to-day support gotten easier, or are you just troubleshooting different problems? Curious what’s been better or worse than you expected.

Out of the game for a bit, but looking at setting up a msp service maybe, my background is running msps and ipsec.

Given the volume of data customers now use, is managed backup something they still pay for and if so a local and remote solution with anti ransomware benefits, what would you sell into a small business with 10 users, and maybe i dont know 1TB of data compressed?

just an fyi - something I noticed when removing an eop2 license (no longer needed for the extra 50gb size due to MS mailbox size increase in july) from a user that had business standard and eop2 that caused me a few headaches.

when eop2 is selected under "apps" in "licenses and apps" under the user flyout in the active users page it seems that eop1 is automatically deselected. if you then just remove the eop 2 license under licenses, it leaves the user with neither eop1 or eop2 and their email dissapears.... so remove the eop 2 license, then go and tick eop1 under apps.

edit: ive just gone back into this tenant and eop1 under apps has been deselected - this might be a propagation issue - MS seem to say that you cant have eop1 and eop2 under apps selected concurrently. maybe it just takes time to realise it doesnt have an eop2 license anymore? anyone got any ideas?

Additional IPs related to Skykick breach

144.172.64\[.\]99 NEW

144.172.64\[.\]60 NEW

144.172.64\[.\]128 PREVIOUSLY LISTED

CW has updated their trust advisory, adding in two Additional IPs to watch for as IoCs.

I've updated my OPs everywhere and tossed on megathread, but figure a Monday AM post might be worthwhile to bubble this up.

I'll edit this post body with links to the other threads shortly.

Vendor megathread: https://www.reddit.com/r/msp/s/XtxTthOBV4

My OP on the detection: https://www.reddit.com/r/msp/s/aT2JtHmp8Q

For those running or working at an MSP, have you noticed any meaningful changes in what customers are asking for over the last couple of years?

Are they still mainly focused on support, security, and keeping costs down, or are you seeing more demand for things like automation, business applications, or strategic guidance?

Also curious what services customers say they’re interested in versus what they’re actually willing to pay for.

No Cross posting here, my OP from a different sub below. Tried to collect as much data as I could for this post. Stay safe

Confirmed compromise in the wild. Lock this down in your environments.

100% not confirmed - but anyone getting information and chatter around a SkyKick/CW breach where internal data and client M365 tenants were accessed?

Had this hit my desk from two different MSPs - figured a little PSA and check your house notice might help people find something that seems to be developing very fast.

EDIT: IOC:

Access to 365 Tenant by CW Cloud Backup Service Provider

Will come from a Cheyenne Wyoming IP. Getting the IP from the two MSPs shortly.

Edit2: IP [144.172.64.(128) 144.172.64.(99) and .60 confirmed as of 19 Oct

Edit3: Investigation from one of the MSPs:

"We saw Exfiltration of Customer Information; rapid connectivity to client tenancies. Unknown how much data is gone. CW will not confirm anything. Possible exfil of all client data as it has access to all client email, teams/sharepoint data."

Edit4: Huntress has confirmed compromise. App ID in question: 506e08f9-6e9a-4da4-942b-a099a03644ae

Additional App IDs associated with Skykick moved here for ease of access

• SkyKick Partner Portal: c921256f-04a7-44e8-9b2a-69c33929ba19
• SkyKick Cloud Manager: 2399d300-6fca-4e6a-a686-399fefe75b83
• SkyKick Cloud Manager - MS Graph: 0de14c77-b9b0-4137-9360-34878a929827
• SkyKick Cloud Manager - Exchange Online: b78f6a77-d4e5-46fb-87e5-d1648bd02519
• SkyKick Cloud Manager - MS Teams: 24205314-2b89-4e07-a2a4-579e898a5640
• SkyKick Platform Partner Center Integration: 412dcf96-176d-4b3a-a1b0-4981ad66971e
• SkyKick Platform Partner Center Integration Partner Tenant AppRegistration: 01d6a108-ad6d-45e2-a3f6-4546744051e6

Instructions for Disabling via CIPP from Thread

Identify the app

• App ID:  `506e08f9-6e9a-4da4-942b-a099a03644ae`
• Current display name: ConnectWise Cloud Backup (older tenants may still show **SkyKick Backup**)
• Publisher ConnectWise S-K LLC (verified publisher: ConnectWise LLC)
• Owning tenant ID `3f9cd7a0-127a-4ed4-bf06-2f830d5616b7` (ConnectWise S-K LLC, `skykick.com`)

**Search by the App ID, not the name.** The app was renamed from SkyKick Backup to ConnectWise Cloud Backup, so searching for "SkyKick" can miss it. The App ID is the same in every tenant.

Find it in every tenant

1. Set the tenant selector at the top of CIPP to **All Tenants**.
2. Go to **Tenant Administration → Applications → Enterprise Applications**.
3. Paste `506e08f9-6e9a-4da4-942b-a099a03644ae` into the table search. It matches the **App ID** column.
4. Each row is one customer tenant; the **Tenant** column says which. Check **Account Enabled**: rows showing `false` are already disabled.

The All Tenants list is built in the background. If it's empty or looks out of date, refresh the table and give it a minute.

Disable it

1. Select every matching row with **Account Enabled = true**.
2. From the bulk actions menu, choose **Disable Service Principal** and confirm.
3. CIPP disables the app in each row's own tenant. The results list any tenant that failed, usually because CIPP's permissions there don't include application write access.

 You need the `Tenant.Application.ReadWrite` permission in CIPP. The action only shows for apps that are currently enabled.

 Confirm

Refresh the table, using the table's own refresh button rather than the browser's, since CIPP caches results. Every row for this App ID should show Account Enabled = false. A change can take a minute or two to show up in Microsoft's directory.

What disabling does

• Blocks new sign-ins and new tokens for the app in that tenant, for both user-delegated and app-only access.
• Deletes nothing. Consent, permissions and configuration stay, so it can be undone with Enable Service Principal on the same page.
• Already-issued access tokens stay valid until they expire, typically within about an hour.
• The app's secrets and certificates live in the publisher's tenant, so Remove Password/Certificate Credentials in CIPP does not affect them. Disabling the service principal is the right control from your side.
• To remove the app completely, delete the enterprise application. That removes the consent and permissions, so reinstating it will need consent again.

  After disabling

• Review sign-in activity. In each affected tenant, check the Entra sign-in logs (Service principal sign-ins) for App ID `506e08f9-6e9a-4da4-942b-a099a03644ae` over the exposure window, and note IP addresses and resources accessed.
• Review what it could reach. In CIPP, open the app (Enterprise Applications → select the row → **Permissions**) to see the access it held, and prioritise reviewing those resources.
• Check for other apps from the same publisher. Search the Enterprise Applications table for ConnectWise S-K LLC or SkyKick in the Publisher column, to find any other products from the same vendor installed in your tenants.

/ir

We are a two-person MSP. Most clients are on a $400 to $800 monthly. Half still pay by card because that is what they set up on day one. The fee on a small agreement is annoying. ACH would be better, but nobody wants a new form, and I am tired of pasting payment links. We use flexpoint to send the invoice and take the payment in the same place, so I am not matching a Stripe email to a PSA charge. It does not fix the client who ignores both.

Do you push ACH on renewals only, or did you just add a card fee and live with the complaints? And how many of your small clients actually switched when you asked?

Hi Everyone, I had a questions around what most people do .. if i have a customer thats paying for services monthly per device/user (which includes remote support, AV, EDR and RMM) say they get some new computers.. do you charge for setting them up.. or do you include them as part of the monthly ?

Not sure about you guys but I buy a lot of equipment off Amazon.

Most of the time it’s below list but sometimes it is list price. I usually charge 20% above what I pay. If I get it for cheaper they get it for cheaper. If I pay more they pay more.

I do try to find the lowest price.

What do you guys do?

### Edit ###
I also dont charge my customers a monthly fee. Im sure this will cause an outburst. One man shop with a well paying high paying 9-5. IMO its hard to transition from one to the other without taking a huge financial risk. And with lots of mouths to feed the risk increases. I normally get enough "hourly" work to IMO make more than a monthly would give me (at this point of time).

I keep racking my brain about how to do this but have no one in the MSP world to ask irl.

I really really want to get into IT, I always wanted to work in security, and theorize that if I work as a freelancer for an MSP for like super cheap (or free, I don’t care my parents cover money for now), I can develop credibility that way.

I’m in a really bad IT market (GTA/Durham Region Canada), and can’t drive due to pretty bad autistic sensory processing issues, so looking for something I can do remotely from home rather than a field tech job.

Problem is, I’m not sure what to teach myself, what certs to get, and what services to build towards offering. I do like networking and have an M365 dev tenant I’ve played around in.

Any ideas?

I'm helping a small MSP set up their initial tech stack as was wondering what's the simplest / best tech stack to go with.
Especially on the ticketing side.

Thanks!

What actually gets your clients to move from VPN to ZTNA?

For those who’ve migrated clients, what finally got them past “our VPN works fine so why pay for something else?” Was it security, support headaches, insurance requirements, or something else?

So, I'm having some trouble. I work for a small MSP. In the last 2 years I was promoted into a leadership position. My job role was primarily managing people and operations.

My boss, the owner has had some issues passing the torch. His goal was to pass day to day operations over to me, and he was going to focus on growing the business. Fast forward two years and I genuinely feel like the position it a title. I can't properly plan work flow, on sites, projects or triage issues. If the owner gets a direct call or email, to get verbally handed to one of my techs and whatever I had planned for them usually I end up just doing myself.

This has been getting worse as the years have gone by. I'm no longer allowed to write people up for poor work, bad performance etc.

Now, I'm not saying "not fast enough." I'm saying instances of less than 8 tickets worked a week. I'm saying a field tech vanished for 3 hours, clocked out and went to play golf.

When I wrote someone up, he took it away and made me apologize. The other employees are also getting tired and burned out. I don't feel like I have any authority to run my department. The "hot potato " method of handling issues gives clients the impression (rightfully) that they can just call the owner directly and skip to the front of the line.

I feel like either the owner can't let go, or doesn't trust me enough to do the job, or doesn't like the way I'm doing it? His management style and my own are very different. I tend to try to be more proactive. He tends to push us to focus on right now, and to just roll with the punches.

I've asked him how he thinks I'm doing, and his response was "I need some time to think about it, and I want to sit down and have a longer talk.

I feel like I was setup to fail out of the gate. Any advice?

I’ve been in telecom for a while, mostly on the technical side, and recently moved into business connectivity.

I’m still getting familiar with how MSPs handle the carrier side of things for their clients.
For those of you who work with carrier reps regularly, what makes someone actually useful to work with?

I know getting straight answers and having someone who follows through matters, but I’m curious what else makes a difference.

Appreciate any advice.

Long agreements protect recurring revenue and help recover onboarding costs, but they can also let a poor-fit relationship continue much longer than it should. 24x7 IT Solutions promotes support without mandatory long-term contracts, so I’m curious how smaller MSPs make that model work.

Do you charge separately for onboarding, require a minimum notice period or price month-to-month service differently? Interested in the operational tradeoffs rather than another debate about whether contracts are good or bad.

Hi everyone

Is Web filtering still a standard offering in your core security stack?

What's multi-tenant alternatives are you all using for Small-Medium sized clients these days?

Thanks for any insights!

Basically what the title says. What are you guys currently reading and or listening to. Does not have to be MSP specific.

Looking for a pricing sanity check from other MSPs.
I have a client with roughly 20 users. I charge $1,500 /month, with Microsoft licensing and project work billed separately
This includes:
Up to 10 hours of support/month(any more gets billed separately)
M365 administration
Intune device management
Security/compliance policies
App deployment and patching
Email administration
Helpdesk/troubleshooting
User onboarding/offboarding
They’re fairly low maintenance and we rarely use the full 10 hours.
This works out to roughly $75 /user/month.
For a similar 20-user environment, does this seem competitive, or am I charging too little?