What should a solo sysadmin prioritize when taking over a small company’s IT?

Keep the initial toolset boring and easy to maintain. A simple ticketing system such as osTicket can help organize requests, while BookStack or even a well-structured existing notes system can handle documentation. An inventory can begin as a spreadsheet and later move to a dedicated asset tool if the organization outgrows it. Security monitoring tools such as Wazuh can be useful, but only if you have the time and knowledge to respond to what they report. Don’t adopt a full ITSM suite until the processes and workload justify it.

Backups and recovery should come first. Confirm what is being backed up, where the copies are stored, how long they are retained, and whether the backups are protected from ransomware. A backup is not proven until you perform a test restoration, ideally of both a file and a complete system. After that, review Microsoft 365 recovery options, administrator accounts, MFA, endpoint protection, patching, and alerting. Once the external attack and recovery risks are under control, move on to internal networking, permissions, inventory, and documentation.

Start by understanding what already exists rather than immediately deploying new services. Get complete access to the outsourced provider, Microsoft 365, domains, DNS, certificates, vendor accounts, administrator credentials, network equipment, server configurations, endpoint management, licensing, and backup systems. Build a basic inventory and architecture diagram, document who supports each system, and identify the important business processes and their dependencies. You can’t sensibly replace or improve something until you know why it exists and what would break if it disappeared.

A sensible order is: establish ownership and access, document the current environment, verify backups and recovery, enforce MFA and least privilege, ensure patching and endpoint protection, then improve monitoring and inventory. After that, introduce network segmentation or virtualization where they solve an identified risk, and automate repetitive work. Treat documentation and change control as part of the job from day one, but keep both lightweight enough that they will actually be maintained.

Avoid building an entire self-hosted platform just because you can. Every service becomes another system you need to patch, monitor, back up, secure, and eventually recover at an inconvenient hour. Since Microsoft 365 is already working, keep suitable workloads there unless there is a concrete reason to move them. SaaS or the existing provider may be a better choice for non-differentiating infrastructure, especially when you are the only person on call.