New employee IT onboarding: a small business checklist
How to have accounts, access and a secure laptop ready before a new hire's first day, and set things up so they are easy to remove when they leave.
A new hire's first morning often goes like this: the laptop is still in its box, the email account was created last night with a password on a sticky note, and nobody is sure which shared folders they should see. It wastes their first day, and the shortcuts taken to rescue it, such as shared logins, admin rights "for now" or a reused password, tend to stay for years. Here is how a small business can have everything ready before day one, in a way that is also easy to undo when the person eventually leaves.
One week before: collect the details
IT problems on day one usually start with missing information. As soon as the offer is accepted, the hiring manager should send whoever handles IT a short request with:
- name, job title, start date, and whether they will work in the office, remotely or both;
- who they report to and whose role theirs is most like, which is the quickest way to decide what access they need;
- the business applications they will use: accounting, CRM, design software, line-of-business systems;
- equipment: laptop or desktop, monitors, headset, phone or extension, building access card;
- any software that needs a paid license, so it can be ordered in time.
A simple form or a shared template makes this the same every time.
Create the accounts properly
- Use your naming convention for the email address and username, so there are no one-off exceptions to remember.
- Assign the license the role needs, not the most expensive one by default.
- Give access through groups, not individual permissions. Add the person to the "Accounts" or "Design team" group and they get the right shared folders, Teams channels and mailboxes. When they change roles or leave, you change the group membership, not dozens of separate settings.
- Grant the least access that works. New staff rarely need everything on day one. It is easier to add access when asked than to discover later who could see the payroll folder.
- Plan the MFA setup. Rather than emailing a password, set a temporary one, or a one-time sign-in code if your system supports it, and have the employee register MFA on their own phone on the first day, with someone there to help.
- Remember the other systems: accounting software, the phone system, the password manager, printers and any vendor portals.
Prepare the computer
Whether the laptop is new or reissued, it should be ready before the person arrives.
- Reissued machines get a clean install, not just a new user profile. The previous user's files and saved passwords should not travel with it.
- Enroll it in your device management if you use one, so it receives the company's settings, updates and security policies automatically and can be locked or wiped if lost.
- Turn on disk encryption (BitLocker on Windows, FileVault on Mac) and keep the recovery key somewhere the business controls.
- Install updates before handover, so the first morning is not spent waiting for restarts.
- Make the employee a standard user, not an administrator. Installing software should go through whoever manages IT.
- Install the security software and the business applications, and check that backup or file sync is set up for the places they will save work.
- Record it: serial number, who it is assigned to and the date, in your asset list.
Day one
- Have the employee sign in for the first time with someone present, set their own password and register MFA.
- Show them where files go: which shared folders or SharePoint sites, and what should not be saved only on the desktop.
- Spend ten minutes on security basics: how to spot a suspicious email, what to do if they click something they shouldn't, and that it is always fine to report it.
- Explain how to get IT help: who to call or email, and what to include.
- Have them read and sign your acceptable use policy if you have one.
- Check the essentials work: email on the laptop and phone, printing, the phone extension, the main business application.
End of week one
Ask the manager and the new employee what is missing. Remove any temporary access granted to get through the first days. Confirm the MFA method is their own and that the laptop has checked in with your management and backup systems.
Keep a record for the day they leave
Everything you set up now is something someone will have to remove later. A one-page record per employee of accounts, groups, licenses, devices and system access turns offboarding into a checklist rather than a hunt. Our guide to Microsoft 365 steps when an employee leaves covers the other end of the process.
Our small business IT support and managed IT services include setting up new staff accounts and devices. If you have someone starting soon and want them ready on day one, call (213) 986-4855.