What should be on an IT onboarding checklist before a new employee’s first day?

Last updated: Oct. 22, 2026

Before a new employee’s first day, have four things ready: their own Microsoft 365 account and license, a managed and encrypted computer, access limited to their role, and a plan to set up multifactor authentication (MFA) with them. Galaxy IT, a Utah-based managed IT and cybersecurity company, built this IT onboarding checklist to show each step and when to start.

The goal is a new hire doing real work before lunch, which happens only when setup is finished first.

What belongs on an IT onboarding checklist?

1. The start date, role, manager and work location, in writing
2. A new user account in the employee’s own name, never a former employee’s account
3. The licenses the role needs, bought and assigned
4. Email, shared mailboxes, Microsoft Teams channels and file access for the role, and nothing more
5. A computer that is updated, encrypted, protected and enrolled in device management, with an asset record
6. Role-specific software, such as practice management, accounting or CAD, installed and tested
7. A plan to set up multifactor authentication with the employee at first sign-in
8. A day-one walkthrough: how to get help, how to report a suspicious email and which policies to sign

A two-person office in Millcreek needs the same list as a 40-person firm in Lehi. The bigger firm just has more role templates to keep current.

How much notice does IT need before a new hire starts?

Give IT at least 24 hours’ notice before a new hire starts, and more whenever you can. That is Galaxy IT’s minimum. The sooner we have the details, the sooner we can order a laptop and get the person set up. Hardware sets most of the pace, and line-of-business software can add time when only the vendor can create users.

What should the owner or office manager send IT?

Send one message with everything IT needs:

• Full name, spelled exactly as it should appear
• Start date and a mobile number for sign-in verification
• Job title and manager
• Where they will work, with a shipping address for remote hires
• Who they are replacing, if anyone
• Any software, shared mailbox, network drive or printer the role needs

Which accounts and licenses should be set up in advance?

Create the account as soon as you have the details, ideally a few days before the start date, in the employee’s own name. In Microsoft 365, a new user gets an automatically created password and must change it at first sign-in. Both settings are on by default (Microsoft Learn). You can add a user before buying a license, but they can’t use email or the apps until one is assigned.

Then add the role’s shared mailboxes, Teams channels and SharePoint folders. On Microsoft 365 Business Premium, group-based licensing means adding the employee to their role’s group handles the license too.

Never hand a new hire a departed employee’s account, even for the same job.

Why shouldn’t you copy a coworker’s permissions?

A coworker of six years has collected access along the way, such as the payroll folder from covering a vacation. Copy their permissions and the new hire inherits all of it. NIST defines least privilege as access limited “to the minimum necessary to accomplish assigned tasks.” Use a short role template instead, and require the owner’s written approval for anything extra.

How do Microsoft Intune and Microsoft Entra ID speed up onboarding?

Microsoft Entra ID and Microsoft Intune speed up onboarding because you build the setup once in the cloud, and every new laptop pulls it down at first sign-in instead of being configured by hand. Entra ID holds the employee’s identity, groups and sign-in rules. Intune enrolls, configures, secures and updates the device and deploys its apps (Microsoft Learn).

Windows Autopilot can take a new laptop from the box to a configured, managed state when the employee signs in, without reimaging. It needs Windows 11 (Pro, Enterprise or Education), a registered device and licensing such as Microsoft 365 Business Premium, which includes Microsoft Entra ID P1 and Microsoft Intune Plan 1 (Microsoft Learn). Business Basic and Business Standard include only a limited subset of Intune.

When a managed client is set up correctly, a new hire can be ready to work on day one without needing to contact us. The setup itself now takes minutes, not days. The 24-hour notice is there so we can order hardware and assign licenses before the start date.

How should a new employee’s computer be prepared?

Finish, test and record the computer before the employee touches it:

• All Windows or macOS updates installed
• Full-disk encryption on (BitLocker on Windows, FileVault on a Mac)
• Endpoint protection installed and reporting to its console
• Enrolled in device management, so it can be updated, locked or wiped remotely
• A standard user account, without local admin rights
• An asset record with the model, serial number, user and date

The FTC recommends encrypting laptops that hold sensitive information. Our guide to secure remote device management covers the day-to-day side.

Can a new hire use a former employee’s laptop?

Yes, if it’s still supported. Save the former employee’s work files first, then wipe the laptop and set it up fresh. On a laptop managed with Intune and Autopilot, Autopilot Reset removes the old user’s files, apps and settings while keeping it enrolled. A laptop you’re retiring gets a full Intune wipe. Reuse the laptop. Never reuse the account.

How should first sign-in and MFA be handled?

Set up MFA during the new employee’s first sign-in, with a manager or IT available in person or on a video call. MFA adds a second check, such as an authenticator app, beyond the password.

CISA asks businesses to require MFA for email, file storage and remote access. Microsoft’s security defaults page says MFA can block “over 99.2% of identity-based attacks.” A 2023 Microsoft Research study of Microsoft Entra ID accounts found MFA reduced the risk of account compromise by 99.22%.

Three habits keep first sign-in safe:

1. Never send a password by email or text, a point the FTC makes too.
2. On Microsoft 365 Business Premium, use a Temporary Access Pass, a time-limited code the employee uses to register MFA. Set it for one-time use with a short lifetime.
3. Register a backup MFA method on day one, so a lost phone doesn’t lock them out in week three.

What password rules should a new employee follow?

Skip the 90-day password change. Microsoft 365 passwords never expire by default, and NIST SP 800-63B-4 says organizations “SHALL NOT require subscribers to change passwords periodically.” NIST puts the weight on length instead: at least 15 characters for a password used on its own.

What should happen on the new employee’s first day?

The first day is for handover and testing, not setup. On the first morning:

1. Hand over the computer and match the serial number to the asset record.
2. Complete the first sign-in and MFA setup.
3. Open email, Teams, shared files, printers and each core application.
4. Show them how to get help and report a suspicious email.
5. Collect a signed confidentiality and security agreement, which the FTC recommends for every new employee, along with your acceptable use policy.

A week later, remove anything granted “just for today.” Everything you record during onboarding is what you’ll remove when the employee leaves.

How do remote and hybrid hires change the checklist?

Remote and hybrid hires need the same checklist with more lead time. Configure, encrypt and enroll the laptop before it ships, and do the MFA setup on a video call. A remote hire in Herriman or Ogden should open the box, sign in and land on the same desktop as someone sitting in your Salt Lake City office. Our post on IT support for remote employees covers what comes next.

What usually holds up a new hire’s first day?

Most first-day delays start with a missing detail, not a broken laptop. These are the gaps we see most often:

• Vague access requests. “Same access as Sam” isn’t a list. Name the mailboxes, folders and groups.
• No license ready. Setup stalls until one is bought or freed up.
• Last-minute notice. Send at least 24 hours’ notice, and more when a laptop has to be ordered.
• A predecessor who was never offboarded. Close out their account, license and files; don’t pass the account on.
• A laptop that isn’t ready. It was reused without a wipe or never ordered, or it runs a Windows edition that can’t join the company setup. Wipe any reused laptop first.
• MFA trouble at first sign-in. It’s usually a wrong phone number or a sign-in code that was never issued.
• Wrong basics and late extras. A name is misspelled, or apps and printers come up on the first morning.

How does Galaxy IT handle new-hire setup for Utah businesses?

Galaxy IT handles employee onboarding and offboarding as part of its managed IT plans. Galaxy IT is a Utah-based managed IT and cybersecurity company with offices in Murray, Utah, serving businesses across Utah, including the Wasatch Front. For clients on our managed IT services, we handle all of it: the account, the computer, the access and the cleanup when someone leaves. Businesses without a managed plan can still get help with new hires; that work is billed separately. See managed IT support in Salt Lake City for local help.

If new hires keep starting without the access they need, or former employees keep theirs too long, request a free IT assessment.

Frequently asked questions

Should a new employee get admin rights on their computer?

No. A new employee should work from a standard user account, because admin rights let malware and mistakes change the whole computer. If a role truly needs admin access, give that person a separate admin account for admin tasks only, approved by the owner.

Can a new hire use the previous employee’s account?

No. Never reuse a departed employee’s account. An inherited account makes it impossible to tell who did what, and it carries over the old employee’s access. Give the new hire their own account and move over only the files and mailbox access they need.

How much notice should we give IT for a new hire?

Give IT at least 24 hours’ notice, and more whenever you can. The sooner IT has the name, start date, role and access list, the sooner a laptop can be ordered and the account set up. If a laptop has to be ordered or shipped, plan on more lead time.

Does every new employee need multifactor authentication?

Yes. The FTC calls for MFA for all employees and contractors who access your network, and CISA recommends it on email, file storage and remote access. Set it up at the new hire’s first sign-in, with a backup method registered the same day.