Remote-first startup IT
IT Support for Startups and Remote-First Teams
IT support for startups: help desk, Google Workspace or Microsoft 365 administration, managed antivirus and clean onboarding and offboarding from the first hire, month-to-month with no minimum.
- No minimum users
- Month-to-month
- Mon–Fri 8am–8pm ET
Who this is for
Startups from two founders up to about 50 people, usually remote or hybrid across several states, where IT currently belongs to a founder, the head of operations or the first People hire.
The typical stack is Google Workspace or Microsoft 365, mostly Macs with a few Windows PCs, Slack, a password manager, an HR platform and a growing list of SaaS apps. Common reasons to bring in help: hiring is speeding up, a customer sent a security questionnaire, or someone left and nobody was sure what they could still reach.
Design-led team? See IT support for creative agencies for Adobe and Figma seats.
What you get for $49 per user per month
- Unlimited remote help desk tickets, Mon–Fri 8am–8pm ET
- Microsoft 365 and Google Workspace administration
- Managed EDR antivirus and automated patching
- Cloud backup monitoring
- New-hire setup and offboarding
Software we work with
Most startups run some mix of the tools below. We configure and connect them and handle day-to-day user issues; product bugs, billing and feature requests stay with each vendor. We are not affiliated with these vendors.
| Area | Common apps | What we handle | What the vendor handles |
|---|---|---|---|
| Identity and productivity | Google Workspace, Microsoft 365, Microsoft Entra ID, Okta | Tenant and domain setup, groups, SSO connections to your apps, MFA enforcement, admin role clean-up and email authentication records. | Platform outages, billing, product bugs and feature requests. |
| Device management (MDM) | Microsoft Intune, Jamf Pro, Iru (formerly Kandji) | Enrollment through Apple Business or Windows Autopilot, encryption, screen-lock and update policies, app deployment, and device reports for audits. | MDM platform features, agent bugs and subscription billing. |
| Password managers | 1Password, Bitwarden | Vault structure, shared vaults per team, recovery setup, and removing departed users. | The product, its security model and billing. |
| HR and onboarding triggers | Rippling, Gusto, Deel, Justworks | Turning start and end dates into account and device tasks, and connecting the HR platform to your identity provider where it supports that. | Payroll, benefits, contractor payments and employment-law questions. |
| Compliance automation | Vanta, Drata, Secureframe | Connecting your MDM and identity provider, fixing failing device and access tests, and collecting IT evidence. | The platform itself, its policy templates and its auditor network. |
| Collaboration and engineering tools | Slack, Zoom, GitHub, Figma, Notion | SSO and user provisioning where your plan supports it, guest access reviews, and removing accounts when people leave. | App features, workspace billing and outages. |
Problems we fix every week
A new hire’s laptop isn’t ready on day one
Zero-touch enrollment lets a laptop registered at purchase configure itself when the hire signs in at home; it’s scoped separately — ask before onboarding.
The founder is the only admin and is on a plane
We set up a second admin and a documented recovery path, so one lost phone can’t lock the company out.
An ex-employee still has Slack or GitHub access
A written offboarding checklist removes the person from every app directly; SSO with automatic deprovisioning (SCIM) adds a backstop where your plan supports it, scoped separately — ask before onboarding.
Vanta or Drata tests failing on encryption or screen lock
Once MDM work is in scope, we push the missing settings and re-run the checks to confirm which devices now pass.
A remote employee got a new phone and can’t pass MFA
Once you or their manager confirms the request, we reset their MFA registration from the admin side.
Read the fix →A Windows laptop asks for a BitLocker recovery key
On Entra ID-joined laptops the key is usually backed up to your tenant, so once you confirm the request, we can look it up and read it to the user.
Read the fix →Files stopped syncing on someone’s laptop
Usually a sign-in, storage or path-length problem; we work through it remotely.
Read the fix →Laptops that set themselves up: zero-touch provisioning
A remote company has no IT closet. You buy the hardware, it ships straight to the new hire, and device management configures it at first sign-in:
| Step | Mac | Windows |
|---|---|---|
| Register the device to your company | Buy from Apple or a reseller linked to your Apple Business account (Apple Business Manager is now called Apple Business), so the serial number appears there | Register the device for Windows Autopilot; your reseller can often do this at purchase |
| Management tool | Jamf Pro, Iru (formerly Kandji) or Microsoft Intune | Microsoft Intune |
| What happens out of the box | Automated Device Enrollment enrolls the Mac during setup; a supervised device can’t be unenrolled by the user | Autopilot joins the PC to Microsoft Entra ID and enrolls it in Intune automatically |
| Licensing note | Depends on the MDM you choose | Automatic Intune enrollment needs Microsoft Entra ID P1, which comes with Microsoft 365 Business Premium |
Once that work is scoped, we build the enrollment profiles, encryption, update policies and app installs, and confirm the device checks in on day one. Hardware, shipping and returns stay with you.
Laptops already in people’s homes can often be enrolled where they are. The route depends on how each was bought:
| Laptop | How it gets enrolled | Erase needed? |
|---|---|---|
| Mac bought through Apple or a reseller linked to your Apple Business account | We assign its serial number to your MDM; Apple says Macs on macOS 14 or later then show a full-screen prompt to enroll. | Usually not |
| Mac bought at retail or on a personal card | The user can enroll it as is, with fewer controls. Full management means adding it to Apple Business with Apple Configurator (Apple silicon or T2 Macs only); the user then has 30 days to release it. | Yes for full management, so back up first |
| Windows PC already in use | Register it for Autopilot and reset it, or on Windows 11 Pro join it to Microsoft Entra ID from Settings > Accounts > Access work or school, which creates a new user profile. | Yes for Autopilot; a direct join doesn’t erase, but files move to the new profile |
We confirm a backup before anything is reset.
Onboarding and offboarding checklists
Your HR platform knows when someone starts or leaves. The gap is getting that date to whoever creates and removes accounts, so we agree on one trigger (an email or ticket from HR) and work from a checklist each time.
New hire
- Three to five business days before the start date: create the Google or Microsoft account, add groups, assign apps through SSO, and order or assign the laptop.
- Day one: confirm the laptop enrolled, MFA is registered and the password manager invite is accepted.
- End of week one: remove any temporary access granted during setup.
Departure
- At the agreed time on the last day, cut off the main account. In Google Workspace, suspend the user and reset their sign-in cookies (Security > Sign in cookies > Reset), which ends active sessions. In Microsoft 365, reset the password, select Sign out of all sessions and block sign-in; sessions can take up to an hour to end, so for a sensitive departure also turn off their email apps in the Exchange admin center.
- Remove the person from SSO apps, the password manager, Slack and any code repositories or cloud consoles, and change any shared passwords or API keys they could see; your engineering lead confirms the repositories, consoles and keys.
- Hand over files. In Google Workspace, transfer Drive and Calendar data before deleting the user; deletion also removes their Gmail. In Microsoft 365, convert the mailbox to a shared mailbox before removing the license, and don’t delete the user account.
- Lock the laptop through MDM right away. A wipe can’t be undone, so wipe only after confirming nothing needed is stored only on the device, then start the return.
- Record what was done and when; that ticket is audit evidence.
Securing accounts: second admin, MFA, password manager, SSO
Start with one identity: Google Workspace or Microsoft Entra ID becomes the account people use to sign in to everything else. Then work in this order:
- Add a second admin before you enforce anything. Google recommends more than one super admin, each held by a separate person; Microsoft recommends at least two emergency access accounts. Write down the recovery path, so turning on MFA can’t lock out a founder who is the only admin.
- Turn on MFA for every account, admins first, using an authenticator app, passkey or security key rather than text-message codes where the app allows it.
- Put shared and non-SSO logins in the password manager, with shared vaults per team instead of passwords pasted into Slack.
- Connect apps to SSO as you adopt them. Check the pricing tier first: Slack includes SAML SSO on Business+ and Enterprise, and GitHub organization SSO needs GitHub Enterprise Cloud. Suspending the main account stops new SSO sign-ins but not sessions already open, so use automatic deprovisioning (SCIM) where available.
Steps 1 and 2 fall under our Google Workspace management or Microsoft 365 support; SSO and password managers are scoped separately — ask before onboarding.
SOC 2 readiness: the IT controls and evidence we help with
A SOC 2 report is issued by an independent CPA firm after it examines your controls against the AICPA’s Trust Services Criteria. Security is part of every SOC 2 report; availability, processing integrity, confidentiality and privacy are added only if you put them in scope. We’re not auditors, we don’t issue reports or “certify” anyone, and no IT provider can promise a clean report.
We can put the IT controls in place and produce the evidence:
| Control area | What we configure | Evidence you can hand over |
|---|---|---|
| Access control | MFA enforced for all users, SSO for in-scope apps | Admin console MFA enrollment report, list of SSO-connected apps |
| Endpoint security | Disk encryption, screen lock, OS updates and endpoint protection through MDM | MDM device reports showing encryption and update status |
| Onboarding and offboarding | Checklists tied to HR dates | Timestamped tickets for each hire and departure |
| Access reviews | Export of users and admin roles for each review you schedule | Review spreadsheet signed off by a manager |
| Backup | Monitoring of your Google Workspace or Microsoft 365 backup service | Backup job reports from your backup tool |
Policies, risk assessments and vendor reviews are yours to own, with our technical input on the IT sections. This is practical guidance, not legal or audit advice.
Some customer questionnaires ask where your IT support staff are located. Our team includes engineers in the United States and overseas. If your customers’ requirements or your own policy limit where support staff can be located, raise it before onboarding so we can tell you plainly whether we’re a fit.
IT support for remote workers
Remote employees’ problems are often home networks, docks and time zones, not the laptop:
- Home internet belongs to the employee’s provider, but we can tell them whether it’s their Wi-Fi or the line and save them time on hold. Our slow internet troubleshooting guide covers the first checks.
- Personal phones get app-level protection, not full management. App protection policies in Microsoft 365 Business Premium, or basic mobile management in Google Workspace, can remove company data without erasing the phone.
- Mind the time zones. Our 8am–8pm Eastern weekday hours are 5am–5pm Pacific, with no weekend or overnight coverage, so West Coast staff should raise late-afternoon problems before 5pm their time.
- Plan for a dead or lost laptop. Keep work in Google Drive or OneDrive, not only on the laptop, and keep a spare enrolled laptop ready. A lost laptop can be locked or wiped through MDM once it next goes online.
Managed IT services for startups: what the plan covers and costs
It’s $49 per user per month, month-to-month, with no minimum number of users and no setup fee. You add a seat when someone joins and drop it when they leave.
Worked example: a 12-person seed-stage company pays 12 × $49 = $588 per month. Hiring three people next quarter takes it to 15 × $49 = $735 a month.
Compared with hiring: the Bureau of Labor Statistics reports a median annual wage of $61,860 for computer user support specialists (May 2025), before benefits and payroll taxes.
Included: unlimited remote help desk tickets; Microsoft 365 and Google Workspace administration (adding and removing users, password resets and security setup); managed EDR antivirus; automated Windows patching and tune-ups; cloud backup monitoring; and new-hire setup and offboarding.
MDM rollouts, SSO connections, password-manager setup and SOC 2 evidence work aren’t on that list; they’re scoped separately — ask before onboarding.
Not included: on-site work (arranged separately as a paid add-on through a vetted local partner technician; see on-site IT support); hardware and parts, including laptops, monitors and shipping; software licenses (Workspace, Intune, Jamf, Iru, Vanta and the rest); audit fees; product infrastructure and DevOps work; and bugs inside a vendor’s own application. Full terms are on the Business Support Plan page, and our explainer on per-user vs. per-device pricing shows why per-user billing tends to suit laptop-and-phone teams.
Who handles your tickets
A US-managed support team with engineers in the United States and overseas, available Monday–Friday, 8am–8pm Eastern.
- Every remote session needs your approval, and you can end it at any time.
- Our engineers use MFA on our own tools, and remote sessions are logged.
- Send auditor or customer questions about IT vendors to us before onboarding.
Your first 30 days
A typical first month; pace depends on headcount, apps and laptops. MDM enrollment is scoped separately — ask before onboarding.
Week 1: Find everything
Who is an admin where, which SaaS apps are in use (from SSO, expense reports and third-party app access in Google or Microsoft), and who controls the domain and DNS.
Week 2: Secure the accounts
A second admin first, then MFA for everyone, password manager rollout, and SPF, DKIM and DMARC on your domain.
Week 3: Enroll the laptops
Connect Apple Business or Autopilot to your MDM, enroll existing laptops, and apply encryption, screen-lock and update policies.
Week 4: Make it repeatable
Onboarding and offboarding checklists go live, the first access review is done, and an evidence folder is started for your next customer questionnaire or audit.
Frequently asked questions
Does a startup need managed IT services?
Not on day one. A founder can run Google Workspace or Microsoft 365 with MFA turned on for the first handful of people. Common tipping points are steady hiring, a first enterprise customer, or a security questionnaire you can’t answer. At that stage laptops, offboarding and evidence for customers take real hours each week, and mistakes such as a departed employee keeping access are expensive to unwind.
Is there a minimum number of users or a contract?
No. The Business Support Plan is $49 per user per month, month-to-month, with no minimum users and no setup fee, so a two-person company pays $98 a month. Seats go up and down with headcount, so you aren’t paying for people who have left. Licenses for Google Workspace, Microsoft 365, your MDM and other software are billed separately by those vendors.
Should a startup get a SOC 2 Type 1 or Type 2 report?
It depends on what your customers ask for, so decide with them and your CPA firm. A Type 1 report checks whether controls are designed properly as of one date. A Type 2 report also tests whether they operated throughout a review period, so the auditor can sample any hire, departure or access review from that window. Offboarding checklists, MDM policies and access reviews therefore need to be running before the period starts. We help set those up and collect the IT evidence; the audit stays with your CPA firm.
Do you buy and ship laptops for new hires?
You buy the hardware and pay for shipping, so you keep control of spending and ownership. Once MDM setup is in scope, we set things up so the laptop can ship straight from Apple or your reseller to the employee’s home and configure itself at first sign-in, using Automated Device Enrollment on Macs or Windows Autopilot on PCs. When someone leaves, we lock the device remotely, wipe it once nothing on it is needed, and you arrange the return.
Should a startup use Google Workspace or Microsoft 365?
Both work. Google Workspace often suits teams that live in the browser and use Macs. Microsoft 365 Business Premium makes sense if you need Windows device management, since it includes Intune, or if customers send you Word and Excel files all day. Switching later is possible but disruptive, so choose for the next two years rather than the next two months. We support either platform day to day; moving from one to the other is scoped separately — ask before onboarding.
Can you work with Jamf or Kandji?
Yes. That work is scoped separately — ask before onboarding. Kandji now operates under the name Iru, and we work inside Iru, Jamf Pro and Microsoft Intune as your admins: building enrollment and configuration profiles, fixing devices that stop checking in, and pulling device reports for audits. You hold the subscription and the owner account, and you can remove our access at any time.
When should a startup hire a full-time IT person?
When IT and security work fills most of someone’s week rather than a few hours: hiring every month, an office with equipment someone has to touch, or a compliance program that needs a daily owner. Before that, one internal owner, often the head of operations or the first People hire, plus an outside team usually covers it. Because our plan is month-to-month, you can keep it alongside a new hire for routine tickets or hand everything over with documentation and admin access.
See whether we’re a fit in 20 minutes
Tell us how many people you have and what you use. We’ll tell you plainly what the $49/user plan covers for you and what it doesn’t.