New starter checklist

A laptop on the desk isn't onboarding. Day one working is.

Good onboarding starts with who approves access, not who creates the account. Prepare the laptop and account from the role, support the first sign-in, test real work on day one, and review access a month in. Build a checklist for your next hire below.

Microsoft details from Microsoft Learn, checked 31 October 2026.

Fix our onboarding Build a checklist 07 3114 2808

Who owns what
Day-one tests
Checklist builder

Reviewed by Blake Bath, General Manager, on 31 October 2026.

A new starter registers sign-in on her phone while a colleague helps set up her new laptop on day one. — **Approve the role, not a copy**Access comes from a role template, never from a colleague's account.

What we see

Four onboarding mistakes that cause problems later.

Each one is quicker on day one and costlier for years.

Copied permissions

Access cloned from a colleague, including everything they collected over the years.

Role templates
Named approval
Month-one review

New starter checklist builder

Build the checklist for your next hire.

Four questions. You get the steps with owners, in order, ready to paste into your HR or ticketing system.

Four questions about the new person. You get a checklist with owners, in order, ready to copy into your HR or ticketing system.

Where will they work?

What device will they use?

What kind of role is it?

How long until they start?

Your checklist

15 steps

Before day one

HR or manager: confirm start date, role, location and reporting manager.
Manager and system owners: approve the apps, data and permission level the role needs.
IT: create a named account from a role template, never a copy of a colleague's access.
IT: assign the licence that fits the role.
IT: order the laptop now, record the asset, enrol it in management and check encryption and protection.
IT: confirm the delivery address, who signs for it, home internet and a booked first sign-in session.

Day one

Supported first sign-in: register MFA or a passkey, test it, and explain how recovery works.
Test a real task in each app the role needs, not just the welcome screen.
Show how to report a suspicious email or a lost device, using the real button or channel.
Show where files belong and how to share them safely.
Record what works, what is missing, and who owns each gap.

First week and first month

First week: approve any extra access found during work, with a reason and expiry.
First week: confirm the device reports as encrypted, updated and protected.
First month: manager reviews access and removes anything unused.
First month: close the handover record, so changes and departure have an accurate starting point.

Fix our onboarding

Before any account

Name the owner of each step.

Owner	Decision or action	Evidence
HR or hiring manager	Confirm the hire, start date, location and manager	Approved request with a contact for changes
Manager and system owner	Approve apps, data and permission level	Named approval, including any temporary exception
IT or service provider	Prepare account, licence, device and access	Setup and test results in the handover record
New employee	Complete sign-in, training and real work tests	Accepted handover and a list of open issues

Preparation

Prepare the account, laptop and delivery.

A named account from a role templateApproved groups, mailbox and app roles. No reused accounts, no admin rights by default.
The right licenceMatched to the apps and security features the role needs.
A prepared laptopAsset recorded, apps installed, management and encryption checked, dock and audio tested.
Delivery and first sign-in bookedFor remote staff: address, recipient, internet and a support session. Instructions sent separately from any temporary code.

With the employee

Test real work with the new person there.

Supported sign-inRegister MFA or a passkey, sign in again, explain recovery. Don't weaken policies to get past a problem.
A real task in each appOpen the record, check read or edit access, test email, files and meetings.
The security routinePassword manager, safe sharing, reporting a suspicious email or lost device.
Where to get helpThe real support channel, and what to include in a request.

Enrolment

What Microsoft enrolment actually needs.

Temporary Access PassA time-limited code to register passwordless sign-in. It must be enabled for the user, with a sensible lifetime and secure delivery. Not required for every first sign-in.
Windows AutopilotNeeds a supported Windows edition, the right licences and setup. A consumer Windows edition won't enrol on its own.
Phishing-resistant sign-inASD recommends phishing-resistant MFA such as passkeys where supported. Set it up on day one, not later.

Our view

Onboarding is where offboarding gets easy, or hard.

Every permission granted on day one is one that has to be found and removed when the person leaves. Starting from a role template, with named approvals and a month-one review, keeps that list short and accurate.

We would rather a new starter spends twenty minutes with us registering a passkey and testing their apps than a week discovering what doesn't work.

The order

Onboarding in five steps.

Step 1Confirm and approve
Start date, role and approved access.
Step 2Prepare
Account, licence, laptop and delivery.
Step 3Day one
Supported sign-in and real work tests.
Step 4First week
Close gaps, approve extras with expiry.
Step 5First month
Manager reviews access, record closed.

Related guides

Joiners, movers and leavers. One record from start to finish.

Access, devices and sign-in.

Get help your way

Six ways to reach us. Pick whichever suits you.

Helpdesk hours are Monday to Friday, 8am to 5pm AEST. On Advantage and above, emergencies get a response within 1 hour and outages within 2, with 24/7 best-effort escalation.

Questions

What people ask about onboarding.

How early should IT hear about a new starter?

As soon as the hire and start date are confirmed. Buying and preparing a laptop, licences and approvals all take time, so agree a lead time in your own process rather than relying on a fixed number of days.

Can we copy a colleague's permissions?

Use an approved role template instead. Copying a colleague carries over years of extra access. The manager and system owners should approve what the role needs.

Does everyone need Microsoft 365 Business Premium?

Not automatically. Match the licence to the role, the apps they use and the security and management features you need.

Is a Temporary Access Pass needed for every first sign-in?

No. It is one Microsoft Entra option for registering passwordless methods. It must be enabled for the user, with a sensible lifetime and a secure way to deliver it.

How should remote staff get their laptop and first sign-in?

Confirm the delivery address and who will sign for it, check their home internet, and book a supported first sign-in. Never put a permanent password in a welcome email.

What should the first-month review cover?

Actual access against what the role needs, temporary permissions, device status, training, and anything still open. That record makes later role changes and departure much cleaner.

Next step

Bring one role and the next start date.

We review your onboarding process, build role templates with your managers, and make day one work, without promising dates before the dependencies are known.

Discuss onboarding 07 3114 2808