IT onboarding is the work of creating a new starter’s accounts, licences and access, and preparing their device, so they can do their job from the moment they sit down. For most small businesses it takes about an hour of preparation per person, spread across the week before they arrive. Left until the morning itself, it costs the new starter most of their first day and the person helping them most of theirs.
Quick answer: A complete IT onboarding checklist covers five things: HR sign-off and the right-to-work check, a named user account with multi-factor authentication enrolled, the licences and group access the role actually needs, a prepared and encrypted device, and a security induction on day one. Start it when the offer is accepted, not the week the person arrives.
In this guide: why new starter setup slips, what to prepare before the start date, the account and access checklist, how to hand over a device safely, what to test in person on day one, and what to review a month later.
Why new starter IT setup goes wrong
The pattern is almost always the same, and it is rarely anybody’s fault. Onboarding sits in the gap between HR, the line manager and whoever looks after IT. HR knows the start date. The manager knows what the person will be doing. IT finds out last, often on the Friday before.
Three things follow from that. Hardware gets ordered too late, because nobody started the clock when the offer was accepted. Access gets granted by copying an existing colleague’s account, which quietly hands the new person permissions they have no reason to hold. And nothing gets written down, so when the same role is filled again in eighteen months the whole thing is reconstructed from memory.
The access problem is the one with consequences beyond a slow first day. The ICO’s guide to data security expects personal data to be accessed only by “those you have authorised to do so”, and for “appropriate access controls” to be in place within your systems. Cloning an account is the opposite of a decision about what someone is authorised to see. If you want a wider view of where access has drifted across the business, our IT audit checklist covers how to review it properly.
What to sort out before the start date
The trigger for IT onboarding should be the accepted offer, not the start date. That usually buys two to four weeks, which is roughly what a laptop takes to arrive, be built and be tested.
Two things have to happen before an account is created. HR confirms the right-to-work check is complete, and the manager confirms what the role needs access to. The second is the one people skip, and it is the one that determines everything else. “The same as Sarah” is not a role profile.
| When | What happens | Who owns it |
|---|---|---|
| Offer accepted | Right-to-work check started, hardware ordered, role access profile agreed | HR and line manager |
| Two weeks before | Device built, encrypted, enrolled and tested; licences purchased | IT support |
| One week before | Accounts created and disabled until day one, groups assigned, mailbox set up | IT support |
| Day one | Account enabled, sign-in tested with the person, security induction | IT support and manager |
| Thirty days | Access reviewed, licences checked, asset register confirmed | IT support |
Creating the account early and leaving it disabled until the first morning is worth doing. It means any licensing or mailbox problem surfaces while there is still time to fix it quietly.
The IT onboarding checklist: accounts and access
This is the part that is worth standardising, because it is the part that creates risk when it is improvised. Work through it in order.
-
A named account, never a shared oneOne person, one account, one identity. Shared logins make it impossible to tell who did what, and they survive long after the people who used them have left.Check: no generic accounts such as info@, admin@ or reception@ are being handed out as sign-ins.
-
Multi-factor authentication enrolled before the first sign-inEnrol it during setup rather than asking the new starter to do it later, when it becomes a task they postpone. Microsoft now requires MFA for sign-in to its admin portals, and the same standard should apply to everybody.Check: the second factor works on the device the person will actually carry. Our guide to setting up MFA in Microsoft 365 covers the options.
-
Licences assigned to the role, not copied from a colleagueDecide which plan the role needs and assign it deliberately. Microsoft’s documentation on adding users and assigning licences walks through the admin centre steps.Check: the licence count in the tenant matches the headcount you are paying for.
-
Group membership instead of individual permissionsPut people in groups that describe the role, and grant access to the group. Individual permissions are invisible, accumulate silently and are almost never removed.Check: the new account’s access can be explained by which groups it belongs to, and nothing else.
-
No administrator rights by defaultA standard user account for daily work, and a separate account for administrative tasks if the person genuinely needs them. This is one of the cheapest controls there is, and it limits what malware can do if the account is ever compromised.Check: can the person install software without asking? If the answer is yes and the role does not require it, change it.
-
Shared mailboxes, distribution lists and calendarsThese are usually what the new starter notices is missing on day two. Work out which ones the role needs at the same time as the main mailbox.Check: the person appears in the team calendar and any rota or on-call list.
-
Applications outside Microsoft 365 or Google WorkspaceAccounting, CRM, payroll, design tools, the website admin. Each has its own account, its own licence cost and its own offboarding step later.Check: every third-party account is listed somewhere, with who approved it.
-
A record in the asset and account registerSerial number, who holds the device, which accounts exist, which licences are assigned, who approved the access.Check: the register is updated the same day, not at the end of the month.
If you run Microsoft 365, most of this is a short, repeatable sequence in the admin centre once the role profile exists. Our Microsoft 365 support page covers how we handle it for the businesses we look after.
Setting up the laptop before handover
A device that arrives from the supplier and goes straight to the new starter has had no security applied to it at all. Five things should happen first, and all of them can be done in the same sitting.
- Turn on full-disk encryption. BitLocker on Windows, FileVault on a Mac. Store the recovery key somewhere the business controls, not on the device. A laptop left on a train is an incident rather than a disaster if the disk is encrypted.
- Apply every available update. Operating system, firmware and the applications you install. The NCSC’s small organisations guide puts keeping devices patched among the basic protections every organisation should have.
- Install endpoint protection and confirm it reports in. Installed is not the same as working. Check the device appears in your console before it leaves your hands.
- Enrol the device in management. This is what lets you push a policy, push an update or wipe the device remotely if it is lost. Without enrolment, a lost laptop is an unknown quantity.
- Build it to the same standard every time. The same applications, the same settings, the same browser configuration. A standard build is faster to support and far faster to replace.
For staff who will work from home at least part of the week, the device setup is only half of it. Home networks, personal devices and shared family computers all change the picture, and our cyber security services cover that side of it.
Day one: what to check in person
Everything above can be done perfectly and still fail on the morning, because a password that works in the admin centre does not always work on the actual laptop in the actual office. Sit with the person for twenty minutes and watch it happen.
- Sign in on the device they will use. Not a test account, not your laptop. Theirs.
- Complete the multi-factor prompt on their phone. This is the step that most often falls over, usually because the authenticator app was set up against a different handset.
- Open the things they will use daily. Email, the shared drive, the CRM, the printer. Anything they cannot open now becomes a support ticket at the worst possible moment.
- Run the security induction. What a phishing email looks like, how to report one, what the acceptable use rules are and who to call. New starters are a known target precisely because they do not yet know what normal looks like, and because they are reluctant to question a request from someone senior.
- Record the acceptable use sign-off. A dated record that the person has read the policy, kept with the HR file.
The induction matters more than people expect. Staff who have been shown what an attempted fraud looks like report them; staff who have not, usually do not. Our guide on training staff on cyber security covers what to put in that first session and how often to repeat it.
What to review after the first month
Thirty days in, three things are worth a ten-minute check.
Access that was meant to be temporary. New starters pick up extra permissions in their first weeks, usually to cover for someone or to finish a handover. Almost none of it gets removed. Compare what the account can reach now against the role profile agreed before they started.
Licences nobody is using. If you bought the higher plan because the role might need it, check whether it did. This is the one part of onboarding that pays for itself.
The asset register. Confirm it still matches reality: the device the person actually has, the accounts that actually exist, the applications that actually got approved.
Doing this consistently also makes the reverse process straightforward. The same register that tells you what a new starter was given tells you what to take back when they leave, which is the whole basis of our IT offboarding checklist.
Scope note: This checklist covers the IT side of onboarding. Contracts, right-to-work evidence, payroll and statutory induction are HR responsibilities, and the two processes need a shared trigger so neither waits on the other.
Frequently asked questions
How far in advance should IT onboarding start?
Start when the offer is accepted, which is usually two to four weeks before the first day. Hardware is the constraint: a laptop has to be ordered, delivered, built, encrypted, enrolled and tested, and any one of those steps can slip. Account creation itself takes under an hour, but it depends on the role profile being agreed first.
Should a new starter have administrator rights on their laptop?
No, not by default. Give them a standard account for daily work. If the role genuinely requires installing software or changing system settings, issue a separate administrative account for those tasks rather than raising the privileges of the everyday one. It limits the damage if the account is ever compromised, and it makes unexpected software changes visible.
Who should own the IT onboarding checklist in a small business?
One named person, with HR as the trigger. The common failure is shared ownership between HR, the line manager and IT, where each assumes another has started. Give one person the checklist, give them the authority to chase the role profile, and have HR notify them the day an offer is accepted rather than the week the person starts.
Do contractors and temporary staff need the same process?
They need the same controls and one extra: an end date set on the account at the point it is created. Contractors are the most common source of accounts that outlive the work, because nobody runs a leaver process for someone who was never an employee. Set the expiry when you set up the account, and extend it deliberately if the engagement continues.
Good IT onboarding is not complicated, but it is easy to leave until it is too late to do properly. The two things that make the difference are starting when the offer is accepted rather than when the person arrives, and deciding what the role needs access to instead of copying somebody else’s account. Everything else follows from those two.
Want New Starter Setup Handled for You?
UK IT Services sets up accounts, licences and devices for new starters as part of managed IT support, so your first day is spent working rather than waiting.
