The new-hire IT checklist

A new hire's first morning tells them a lot about your company. If they spend it watching someone hunt for a spare laptop and guess at a password, that's the impression. Most of it is preventable with a week's notice and a list.

This is the list I use with small offices around New Hampshire and the Seacoast. It assumes Microsoft 365, because that's what most of our clients run. If you're on Google Workspace, the steps are the same with different menus.

One week before the start date

Ask for the start date, job title, manager, and which existing employee this person's access should look most like. That last question saves more time than anything else on this page. "Same as Jen in accounts payable" is a clear spec. "Whatever they need" is not.

Account and license

• Create the user in Microsoft 365 (or in Active Directory, if you still sync from an on-site server).
• Assign the right Microsoft 365 license. Business Standard and Business Premium are not the same. Premium includes Intune and Defender for Business, and for most offices it's the one you want for anyone with a company laptop.
• Add them to the right groups, not one-off permissions. Groups are how access stays clean when people change roles.
• Set up their email signature, and add them to the shared mailboxes and distribution lists they'll need (info@, billing@).

Sign-in security

• Require multi-factor authentication from the first sign-in. Use the Microsoft Authenticator app, not text messages, where you can.
• Plan how they'll enroll. The easy way is a Temporary Access Pass in Entra ID that lets them set up MFA on day one without anyone reading a password over the phone.
• Invite them to the company password manager (1Password, Bitwarden, Keeper, whichever you use) and share only the vaults their role needs.

The laptop

• Order hardware early. Business-class laptops can take a week or more to ship, and "the store had one" laptops come with consumer Windows editions and bundled junk.
• If you use Windows Autopilot and Intune, the device can ship straight to the employee or the office and configure itself at first sign-in. That's what we set up for clients when we can, and it's the cleanest option for remote hires.
• If you don't, image or set up the machine in advance: Windows updates, Microsoft 365 apps, your line-of-business software, printers, VPN if needed, BitLocker encryption on.
• Confirm endpoint protection is installed and reporting in. A laptop that isn't checking in to Defender (or whatever you use) is a laptop nobody is watching.

Line-of-business access

This is the part that usually breaks. Say you run a dental office in Nashua. The new front-desk hire needs the practice management system, the imaging software, the phone system, the payment terminal login, and maybe the insurance portals. None of those live in Microsoft 365, and each one has its own admin.

Make a short list, per role, of every system that needs its own account. Keep it with your IT documentation. Next time you hire for that role, half the work is done.

Common ones to remember:

• Accounting software (QuickBooks Online, Sage, a tax suite)
• Industry software (practice management, ERP, CAD, scheduling)
• The phone system and voicemail
• Building access: keys, fobs, alarm codes
• Vendor and bank portals, which should use the person's own login, never a shared one

Day one

• Hand over the laptop and sit with them for the first sign-in and MFA setup. Fifteen minutes now saves a support call later.
• Show them where files live. "Client folders are in the Clients SharePoint site, your personal work goes in OneDrive, nothing on the desktop." Say it out loud.
• Show them how to ask for IT help and who to call.
• Spend five minutes on security: how to report a suspicious email, and that nobody from IT will ever ask for their password or an MFA code. Consider sending them to a short training module in their first week.

The other half: offboarding

Every new-hire checklist needs a twin. Most small businesses I meet have a decent process for starting people and almost none for when they leave. That's where the risk is.

When someone leaves:

• Block sign-in in Microsoft 365 and revoke their sessions the moment their employment ends, not at the end of the week.
• Reset or remove their MFA methods and remove them from the password manager. Rotate any shared passwords they knew.
• Convert their mailbox to a shared mailbox if someone needs to keep reading it. Move OneDrive files they owned before you delete the account. Microsoft keeps a deleted user's OneDrive for only 30 days by default.
• Collect the laptop and phone. Wipe company data from personal phones through Intune if you manage them.
• Remove them from every line-of-business system on that role list you made.
• Change door codes and alarm codes if they had them.

Don't delete the account on day one. Block it, keep it a few weeks, then remove it once the data is moved. Deleted is hard to undo. Blocked is easy.

Questions people ask

Brady McNeill is the founder and CEO of Dreamline Technology. He has spent 12+ years running IT and security for small and mid-sized businesses across New England.