New Employee IT Onboarding Checklist: Ready on Day One

New Employee IT Onboarding Checklist: Ready on Day One

Good IT onboarding means a new employee sits down on day one to a working laptop, an account that already has the right access, MFA set up in person, and a clear idea of how to get help. Bad onboarding means a morning of waiting, a borrowed password, and access copied from whoever had the job before — which is where most permission sprawl and many security shortcuts begin. The difference is a checklist, an owner, and a trigger from HR.

A week before day one

IT cannot prepare for someone it has not heard about. The process starts when HR or the hiring manager sends IT the start date, job title, manager, location, and anything unusual about the role.

• Create the account from a role template. Group memberships for the role decide which shared mailboxes, Teams, SharePoint sites, and applications the person gets — not a copy of someone else’s permissions.
• Assign licenses. The right Microsoft 365 plan, plus seats for line-of-business software, accounting, or design tools.
• Prepare the device. A laptop enrolled in Intune with encryption, endpoint protection, standard apps, and printers configured before it is handed over. With Windows Autopilot, a new laptop can configure itself the first time the user signs in.
• Set up phone and extras. A phone extension or Teams number, building access, and any hardware like headsets or a second monitor.

Day one

• Verify identity in person. Hand over sign-in details face to face or by a verified channel — never by emailing a password to a personal address.
• Set up MFA together. Register the authenticator app or a passkey with someone from IT present, so it is done right the first time.
• Introduce the password manager. A company vault from day one means passwords never live in a notebook or a browser on a personal device. Here is why that matters.
• Show where files live. Which SharePoint sites and Teams to use, what not to save to the desktop, and how files get shared outside the company.
• Explain how to get help. The help desk email or number, what to report, and what IT will never ask for.
• Cover security basics in fifteen minutes. How to report a suspicious email, why payment changes always get a phone call, and what to do after clicking something by mistake.

The first thirty days

• Enroll the person in security awareness training and the next phishing simulation.
• Check with the manager that the access is right — nothing missing, nothing extra.
• Remove any temporary access granted to get through the first week.
• Confirm the device is reporting healthy: patched, encrypted, protected.

Onboarding remote hires

When the new employee never visits the office, the same checklist applies with a few changes. Ship the laptop straight from the supplier or from IT, still in its box, enrolled in Autopilot so it configures itself at first sign-in. Verify identity on a video call, comparing the person to the ID on file with HR, before giving them anything that unlocks the account. Use a short-lived Temporary Access Pass so they can register MFA on their own phone without a password ever being sent. Then schedule a short screen-share on day one to confirm email, files, and phones work, and to walk through the security basics.

Role templates are the secret

The single most useful onboarding improvement is defining access by role. When a new bookkeeper gets the “Accounting” groups rather than a copy of the last bookkeeper’s account, they do not inherit years of leftover permissions. It also makes the other end of employment simple: the same groups get removed when someone leaves, which is the heart of our offboarding checklist.

Common onboarding mistakes

• Shared accounts. “Just use the front desk login” means no accountability and a password nobody can ever change.
• Local admin rights by default. Giving new users administrator rights on their laptop to avoid install requests trades a minor convenience for a major risk.
• Personal email for work. Business communication on personal accounts leaves the company when the person does.
• Passwords sent by email or text. If the message is intercepted or forwarded, the account is compromised before the person even starts.
• No trigger from HR. If IT finds out about a new hire when they walk in the door, every item above gets rushed.

Onboarding as a standard request

With Equal Tech Solutions’ managed IT, a new hire is a single request: send us the start date and role, and the account, licenses, and pre-configured laptop are ready when the person arrives. Contact us to set up an onboarding process your managers can rely on.