IT Onboarding Checklist for New Staff

Format: firstname.lastname@company.com. Set initial password, force change on first login.

Assign correct licence tier based on role. Add to relevant distribution lists and team shared inboxes.

Use role-based access — groups should grant access to systems, not individual assignments.

Intune/Jamf/SCCM enrollment, full disk encryption, AV agent, conditional access compliance checked.

Use SCIM provisioning where available for automatic provisioning/deprovisioning.

Test VPN from device before handing over. Nothing worse than debugging VPN on day 1 with a new starter.

Coordinate with facilities. Least-privilege applies to physical access too.

First impressions matter. A branded, organised welcome pack creates a professional experience.

Allow 24 hours for manager to raise any access changes before start date.

Stay for 15 minutes to troubleshoot. First login issues on day 1 are demoralising and easily prevented.

Walk through MFA enrollment in person. Ensure they know how to handle MFA prompts.

Force first-login password change in Entra ID or AD. Ensure the new password meets NIST 800-63B minimum length.

Also verify meeting invitations are working and shared calendars are visible.

Key applications that need VPN should be demonstrated working.

Demo storing first credential. Show how to use the browser extension.

Set expectations: tell them what to do when something breaks, who to call.

Should cover: phishing awareness, data handling, password policy, AUP. Require completion within 5 days.

Add this to IT setup guidance/checkist given to remote workers. ISP-default passwords are insecure.

Full-tunnel VPN for all work activity, or split-tunnel with defined work traffic routed through tunnel.

Teams/Zoom require ~ 1.5 Mbps upload for 1080p. Below 5 Mbps will cause dropped calls during busy periods.

Data protection obligation. Provide privacy screens for RESTRICTED data handlers.

Include this in the remote working policy. Many home printers store documents in internal memory.

Ensure remote staff know the out-of-hours IT security contact and steps to report a lost device.

Disable at 17:00 on last working day (or immediately for misconduct terminations).

Set up auto-reply directing correspondence to their manager. Forward will of emails for 30 days.

Verify in your VPN system that the account is inactive and cannot authenticate.

Use your SaaS inventory from onboarding to work through each application systematically.

BitLocker/FileVault is not sufficient alone. Perform a certified wipe before re-issuing.

If they had GitHub access, revoke their PAT and rotate any deploy keys they created.

This is why shared passwords are bad practice. Document all shared passwords changed with dates.

Email facilities/building management. If card not retrieved, deactivate immediately.

Search AWS/Azure/GCP IAM for their username and remove all access.

Transfer ownership of business files. Do not delete their files for 90 days in case of disputes.

Evidence of completed offboarding required for ISO 27001 and audit purposes.