What good onboarding achieves

A new employee should receive the device, accounts and access needed for their role without inheriting unnecessary privileges. A repeatable process reduces first-day delays, makes ownership clear and creates a matching record for future role changes or departure. The manager, not the technician, should decide what business information the role is allowed to use.

Plan before day one

  • Confirm the employee's legal name, preferred display name, role, manager, start date and work location through an approved internal route.
  • Choose a suitable business-owned device and record its model, serial number and assigned user.
  • Identify required email, applications, shared mailboxes, Teams, files, printers and line-of-business systems.
  • Ask each system owner to approve access rather than copying another employee's permissions.
  • Assign only the licences needed for the role and record any ongoing cost.
  • Configure updates, encryption, security protection, screen lock and approved recovery arrangements.
  • Set up multi-factor authentication with the employee using an approved method.
  • Prepare a simple first-day handover covering sign-in, support, safe data handling and how to report a suspicious message.

Keep initial passwords temporary and private. The employee should set their own password through the approved process rather than receiving another person's credentials.

Check the result

On the first day, confirm the employee can sign in, use email, reach only the required shared data, join meetings, print if needed and contact support. Check that access denied is not automatically treated as a technical fault; it may reflect a missing business approval. Record equipment issued and ask the employee to confirm receipt.

Set a short follow-up after the first week. This catches missing access without granting broad permissions on day one.

What not to do

Do not reuse a former employee's account, share accounts or email a permanent password. Do not make the employee an administrator merely to make installation easier. Avoid copying another person's full access set, leaving temporary permissions undocumented or using personal storage for business files.

When to stop and ask for help

Pause if account ownership, licensing, data classification, device security or approval is unclear. Regulated, financial or sensitive systems may require extra checks. If the start is urgent, record any controlled temporary arrangement, its approver and expiry instead of silently bypassing the process.

Prepare for support

Provide the role, start date, device requirement, approved application and access list, manager, system owners and working location. Explain whether the business already has Microsoft 365 or another identity platform. Keep personal information to the minimum needed and send it only through an authorised channel.