What Most Day 1 Runbooks Get Wrong
The standard Day 1 runbook is a checklist. Cut over mailboxes. Migrate file shares. Disable old accounts. Provision new accounts. Test VPN. Update DNS.
This checklist works if the target IT environment is exactly what the pre-close assessment said it was. It breaks if it isn’t. And in our experience running post-mortems on 40+ integrations, the pre-close assessment is wrong in at least 4 critical ways on every single deal.
The Three-Day Discovery Sprint Before Day 1
Before the integration runbook matters, you need to know what’s actually in the estate. This means running a complete discovery sprint in the final week before close.
Day 1-2: Full estate discovery. 89 modules running across all cloud environments, AD, Entra ID, and M365. Output: complete inventory with dependency mapping.
Day 3: Finding prioritization. Every finding scored on two axes: business criticality and integration risk.
Day 3-4: Workstream planning. The prioritized finding list becomes the Day 1 through Day 30 workstream plan.
The First 72 Hours: What to Fix, What to Let Run
Fix immediately:
- Overprivileged accounts with production dependencies — A service account with domain admin rights that runs a critical application is both a security risk and a single point of failure.
- Stale credentials on authentication paths — Any service principal, managed identity, or API key that expires in the next 60 days and is used in a production authentication path.
- Orphaned accounts in privileged groups — Accounts belonging to employees who left more than 60 days ago that are still in Domain Admins or Enterprise Admins.
Let run: Shadow IT inventory, SaaS duplicate tooling, GPO analysis findings, cloud resource optimization.
Week 1: The Three Meetings
Morning sync (8:30 AM): Status on the integration workstream. What was completed last night. What’s in progress. What’s blocked.
Midday check (12:00 PM): Dependency check. Did anything that got completed change the dependency map for the afternoon’s work?
End of day review (5:30 PM): Finding log update. What was discovered today that wasn’t in the discovery sprint output.
The 30-Day Exit Criteria
- All Day 1 critical systems are operational in the new environment
- All identity cutover has been validated
- Network continuity has been confirmed
- Shadow IT inventory is complete and contract review has begun
- Integration roadmap for the next 60 days is drafted and approved
ACQI runs the 30-day integration sprint discovery in 48 hours, with a prioritized finding list and dependency map ready before Day 1. See a sample integration sprint plan.