A new hire should be working by 10 a.m. on day one

The short answer

Good IT onboarding starts about five business days before the new hire arrives. HR sends a request with name, role, start date and manager. IT creates the account, assigns licenses and group memberships by role, prepares a laptop that enrolls itself in management, and sets up multi-factor authentication on day one with a one-time pass. The manager confirms access to the right shared folders and apps. Security basics and a short walkthrough happen in the first week. Every step has one named owner. The checklist below covers each stage.

Why onboarding needs a checklist

Onboarding done from memory goes wrong in two predictable ways. Either the new hire sits idle for half a day waiting for a login, or someone copies an existing employee’s permissions and the new person inherits years of access they should never have. Both are avoidable with a standard request form and a role-based checklist.

Onboarding also sets up offboarding. If you record every account, license and device you give someone on day one, removing them on their last day is simple. We cover that side in our employee offboarding IT checklist.

Five days before: the request

Owner: HR or the hiring manager. Send IT a single request with:

• Full legal name and preferred name for email
• Job title, department and manager
• Start date, work location and whether they are remote, hybrid or in the office
• Employee or contractor, and the end date for contractors
• The role template to use (see below) and any extra apps
• Equipment needs: laptop, monitors, headset, phone
• Shipping address if the device goes to their home

Five business days gives time to order hardware if stock is short. If HR uses an HR system, connect it to your directory later so new hires create accounts automatically. Our systems integration team handles that kind of link.

Three days before: accounts and access

Owner: IT.

• Create the user in Microsoft 365 or Google Workspace with a consistent naming format.
• Assign the license for the role, not the most expensive one by default.
• Add the user to security groups and distribution lists defined by the role template.
• Grant access to shared folders, SharePoint or Shared Drives through groups, never one person at a time.
• Create accounts in line-of-business apps: accounting, CRM, practice management, phone system.
• Set up a password manager account and share only the team vaults the role needs.
• Record every account and license in the user’s onboarding record.

Build role templates, not copies

A role template is a short list of groups, licenses and apps for each job type: front desk, sales, accounting, project manager, manager. New hires get the template for their role, nothing more. Changes go through the manager.

Templates make onboarding faster and make access reviews possible. When you review who has access to the finance folder, you check one group rather than forty individual permissions. They also prevent privilege creep, where long-serving staff slowly accumulate access from every role they ever covered. Start with your five most common roles and add others as they come up.

Two days before: the device

Owner: IT.

• Assign a laptop and record its serial number against the user.
• Enroll it in device management. With Windows Autopilot, Microsoft’s provisioning service, a new device can configure itself with your apps and settings when the user signs in, even when shipped straight to their home.
• Confirm encryption, endpoint protection and automatic updates are on.
• Install the role’s apps and printers.
• Redirect Desktop and Documents to OneDrive or the Google Drive equivalent so files are backed up from day one.
• Ship or set the device on the desk with monitors, dock and headset.

Day one: sign-in and MFA

Owner: IT, with the manager.

• Give the new hire a time-limited way to sign in the first time. Microsoft Entra’s Temporary Access Pass is a time-limited passcode built for exactly this: it lets a new user sign in and register their own authentication methods without a temporary password.
• Register multi-factor authentication before anything else. CISA calls phishing-resistant MFA the standard to aim for, and says any MFA is better than none.
• Have the user set a long passphrase. NIST’s digital identity guidelines favor length over forced complexity and discourage routine forced password changes.
• Walk through email, chat, file storage and how to ask for help.
• Confirm access to every app on the role list and log anything missing.

If your onboarding currently depends on one person remembering every step, it is worth knowing where else that is true. Our free Technology Health Assessment rates your IT operations and cybersecurity in a plain-language report the next day, with a short list of next steps in order.

Week one: security basics

Owner: IT or office manager.

• A 20-minute session on spotting phishing, verifying payment changes by phone and reporting suspicious email.
• Your acceptable use and remote work policies, signed.
• How to lock a screen, where to save files and why not to use personal cloud storage.
• How to report a lost device the same day.
• A check-in at the end of the week to fix any access problems.

Contractors, interns and temporary staff

Short-term people need the same discipline, with two additions. First, set an expiry date on the account when you create it, matching the contract end date, so access stops even if nobody remembers. Second, give them the narrowest role possible and avoid shared mailboxes or vaults that hold sensitive data unless the work requires it.

If a contractor brings their own laptop, decide in advance what they may access from it. Many businesses limit unmanaged devices to web access with no downloads, or provide a company laptop for the length of the engagement.

Common onboarding mistakes

• Emailing a temporary password to the new hire’s personal address.
• Leaving MFA setup until “later”, which often means never.
• Giving local administrator rights so the person can install their own software.
• Assigning a laptop without recording its serial number, which makes recovery at exit harder.
• Forgetting the phone system, door access or the building’s visitor list.
• No check-in at the end of week one, so access gaps turn into workarounds such as shared logins.

Who owns each step

• HR: request form, start date, contractor end dates, policy signatures.
• Hiring manager: role template choice, extra access approvals, day-one welcome, week-one check-in.
• IT: accounts, licenses, groups, device, MFA, security training and the onboarding record.
• Office manager: desk, keys or badges, phone extension.

JLB USA provides managed IT for businesses with roughly 25 to 100 employees, including computers, Microsoft 365 and Google Workspace, user setup and same-day removal of leavers. We reply within 5 minutes by email or phone, so a forgotten new-hire request is fixed fast.

Keep reading

• How often should business computers be replaced?
• Windows 10 end of life for business: what it means in 2026 and what to do now
• What a managed services agreement should include, and the red flags to push back on
• Outsourced IT vs in-house IT: which is right for your business?

Related services

• Managed IT services
• Free Technology Health Assessment
• Employee offboarding IT checklist
• Systems integration