The One On-Call
The One On-Call is a purpose-built on-call management platform for MSPs — giving service managers full control over rotation schedules, escalation policies, and incident response across their entire team.
What On-Call Does
On-Call is your after-hours coverage layer. MSP service managers use it to define who is reachable at 2am, in what order, and through what channels — so that critical alerts from RMM, Defend, Security, and PSA reach the right technician immediately and escalate automatically if nobody responds.
| Capability | Description |
|---|---|
| On-Call Schedules | Multi-layer rotation schedules with daily, weekly, or custom intervals — with time-of-day and day-of-week restrictions |
| Escalation Policies | Multi-step escalation chains with configurable delay per step, repeat cycles, and targets at the user, schedule, or team level |
| Incident Management | Full incident lifecycle: triggered → acknowledged → resolved, with notes, timeline, and PSA ticket auto-creation |
| Alert Ingestion | Generic webhook receiver plus native integrations with RMM, Defend, Security, and Backups — with deduplication and alert grouping |
| Schedule Overrides | Temporary overrides for vacations and emergencies — API-complete, manager or self-service |
| On-Call Now | Live view of every currently on-call technician across all active schedules |
| Coverage Gap Detection | Daily automated scan for uncovered windows — admin email alerts before shifts go dark |
| Reporting | 30-day MTTA, MTTR, incident volume by severity and service, escalation rate, and on-call burden |
| Notification Channels | Email delivered today; SMS, phone, push, and Slack channels prepared in preference schema |
| Defend Integration | When Defend detects a critical threat, On-Call pages the on-call technician directly with device name, MITRE technique, and recommended action |
Who Uses On-Call
- Service Manager — Builds and owns schedules, escalation policies, and service definitions. Reviews on-call burden reports and coverage gaps.
- On-Call Technician — Receives alert notifications, acknowledges incidents, adds resolution notes, and triggers PSA ticket creation.
- MSP Owner / Operations Lead — Reviews MTTA/MTTR trends, on-call burden distribution, and alert volume by source.
How On-Call Fits in the Stack
On-Call sits at the intersection of your monitoring and response layers:
- RMM → On-Call: Critical device alerts trigger on-call incidents when a threshold is breached
- Defend → On-Call: Defend critical and high-severity detections page the on-call technician with full MITRE context
- Security → On-Call: Critical and high-severity security events (M365 posture, dark web) escalate to on-call
- Backups → On-Call: Backup failures trigger on-call alerts for after-hours response
- On-Call → PSA: Acknowledged incidents auto-create PSA tickets; resolution notes flow back to the ticket
- On-Call → Hub: Authenticates through Hub SSO; active user count reported to Hub Billing
ℹ️On-Call is available at app.theoneoncall.app. Access it from the waffle menu in The One Hub.
Prerequisites
- A Hub organization with at least one admin user
- Hub SSO configured (On-Call authenticates through Hub)
- For Defend alerting: Defend deployed with
DEFEND_SERVICE_KEYset on the On-Call API - For PSA ticket creation: PSA connected and
PSA_API_URL/PSA_SERVICE_KEYconfigured
Next Steps
- Getting Started — Initial setup and your first schedule
- On-Call Schedules — Building and managing rotation schedules
- Escalation Policies — Defining who gets paged and in what order
- Alert Routing — Routing alerts from RMM, Defend, and other sources
- Incident Management — How technicians receive and respond to pages
- Reporting — MTTA, MTTR, and on-call burden analytics