Software Installation Checklist
Workflow for an IT team or MSP tech to install, validate, and document new software on a managed endpoint or server. Covers pre-flight checks, packaging and deployment, post-install hardening, and change-record closeout.
Pre-Install Review
-
Open or link the change ticket
Create or attach the RFC in the PSA (ConnectWise, Autotask, HaloPSA, ServiceNow, Jira Service Management). Even a single-endpoint install needs a ticket so the audit trail and CMDB asset history are intact.
Collects text Collects text Collects text -
Confirm license entitlement and seats
Pull the license key, seat count, and renewal date from the vendor portal or IT Glue / Hudu. Installing past the seat cap is a common cause of activation failures mid-rollout.
-
Classify the change risk level
Standard / Normal / Emergency per ITIL change types. Blast radius — not package size — drives this. A one-line agent push to 200 endpoints is Normal; a kernel driver to a single workstation may also be Normal.
Collects list -
Submit to CAB for review
Bring the install plan, rollback plan, and test evidence to the next Change Advisory Board. Capture approval in the PSA before any production action.
System Readiness
-
Verify OS and hardware against vendor requirements
Match the vendor's stated minimums against actual endpoint inventory in Intune, Jamf, Kandji, or NinjaOne — CPU architecture (x64 vs ARM64), OS build, RAM, .NET / VC++ runtime versions. ARM64 vs x64 mismatches are a recurring source of silent install failure on newer Macs and Surface devices.
-
Confirm free disk and required runtime libraries
Plan for 2-3x the installer footprint to cover temp extraction and rollback restore points. Confirm prerequisite runtimes (.NET, Java JRE/JDK, VC++ redistributables, PowerShell version) are present at the version the vendor specifies — not just "installed."
-
Validate network paths and firewall rules
Cross-reference the vendor's published egress endpoints against NGFW (Palo Alto, Fortinet, pfSense) ACLs. ZTNA / SASE policies often need a per-app allowlist update — license activation calls home over a different domain than the installer download.
-
Take an MDM-managed restore point
Trigger a Veeam / Datto / Druva snapshot, a Windows System Restore point, or a Time Machine sync depending on platform. For servers, confirm the latest backup is recent and verified — not just scheduled.
Package and Deploy
-
Download the installer from the vendor source
Pull the installer directly from the vendor portal or a verified mirror. Never use a copy emailed by an end user — supply-chain compromises (3CX, SolarWinds) reach in through trusted-looking channels.
-
Validate the installer hash and code-signing certificate
Compare SHA-256 against the vendor's published checksum and confirm the Authenticode / notarization signature matches the expected publisher. A mismatched or missing signature is a stop-the-line event — open a security ticket before proceeding.
Collects list Collects text -
Escalate the hash mismatch to security
Halt the deployment. Page the on-call security engineer via PagerDuty or Opsgenie, quarantine the installer, and capture the source URL plus referrer. Treat as a potential supply-chain incident until proven otherwise.
-
Pilot the install on the test ring
Push to the IT pilot group (typically 5-10 endpoints) via Intune, Jamf, Action1, or Automox. Watch EDR (CrowdStrike, SentinelOne, Defender) for false-positive blocks and tune exclusions before broad release.
-
Roll out to the production ring
Stage the production deployment in waves — 10%, 50%, 100% — through the RMM or MDM. Phased rollout limits blast radius if a regression slips past the pilot ring.
Post-Install Configuration
-
Apply the hardened configuration baseline
Apply the CIS Benchmark or vendor-hardening profile via Intune configuration profile, Jamf policy, or Ansible playbook. Disable telemetry channels not approved by the data-handling policy.
-
Wire up SSO and SCIM provisioning
Connect the app to Okta, Entra ID, Google Workspace, or JumpCloud via SAML or OIDC and enable SCIM where the vendor supports it. Apps without SSO + SCIM become offboarding gaps — flag for vendor review if the connector is missing.
-
Move credentials into the secrets vault
Store license keys, API tokens, and any service-account credentials in HashiCorp Vault, AWS Secrets Manager, Azure Key Vault, or 1Password. Never check them into Git or paste them into the PSA ticket body.
-
Run the smoke test
Launch the app, sign in via SSO, exercise the top three end-user workflows, and confirm logs are reaching the SIEM (Splunk, Datadog, Sumo, Elastic). A green install that doesn't log isn't done.
Collects list Collects paragraph
Closeout and Documentation
-
Execute the rollback plan
Restore from the pre-install snapshot, push the uninstall package via MDM, and confirm the endpoint is back to baseline before closing the change as Failed. Capture the failure cause for the postmortem.
-
Update the CMDB and IT Glue records
Record installed version, license key location, SSO connector ID, and owning team in IT Glue, Hudu, or the ServiceNow CMDB. Stale CMDB data is the single biggest reason offboarding misses an app.
-
Notify end users and update the runbook
Send the user-facing change notice, link the KB article in Confluence / Hudu, and update the on-call runbook with any new alert routing. Helpdesk needs the article live before the rollout closes, not after the first ticket arrives.
-
Close the change ticket
Mark the RFC Successful, Successful with Issues, or Failed. Attach smoke-test evidence, hash verification, and CAB approval — auditors trace SOC 2 CC8.1 and ISO A.12.1.2 evidence back through this record.
Collects list Collects signature
Use this template
Copy it to your account, customize the steps, and run it with your team in minutes.
Browse hundreds of free templates across every team and industry.
Back to template libraryRun Software Installation Checklist with your team
Customize the steps, assign roles, set a schedule, and keep a complete record for every run.