Remote SupportOverview
Day one sets the tone. A smooth IT onboarding signals a well-run business. A bad one loses the starter two days of productivity and tells them the organisation is chaotic. This checklist separates IT tasks from HR tasks and sequences them properly.
Before Day One (Ideally 5+ Days)
- HR notifies IT with start date, role, manager, and office location
- Provision Entra ID / AD account with appropriate role-based groups
- Assign M365 licence (Business Premium by default)
- Create mailbox and populate signature
- Add to required Teams, SharePoint sites, and distribution lists
- Prepare device via Autopilot (Windows) or ABM (Mac / iOS)
- Order hardware if not in stock: laptop, monitor, dock, peripherals, phone
- Provision to line-of-business apps (CRM, ERP, accounting, ticketing)
- Generate temporary access pass (TAP) in Entra ID for passwordless first login
- Send welcome email with day-one instructions, pickup or delivery time
Day One
Collect or deliver device
Employee unboxes, connects to WiFi, starts Autopilot / ABM enrolment.
First sign-in using TAP
No password on day one. Temporary Access Pass for passwordless first sign-in.
Register MFA methods
Authenticator app, passkey, or FIDO2 key. Register two methods at minimum.
Change temporary password
Complex, unique, stored in the password manager.
Enrol in password manager
Keeper, 1Password, or Bitwarden invite accepted. Browser extension installed.
Complete security induction
Phishing awareness, acceptable use policy, incident reporting. 15-20 minutes.
Introduction to IT support
How to raise tickets, who to contact, what to expect.
Verify access to key systems
Mailbox, Teams, key apps, printer, shared drives.
First Week
- Confirm device is compliant in Intune (encryption, patching, AV, firewall)
- Additional app provisioning discovered during week one
- Team and project-specific access confirmed
- Mobile device enrolled with App Protection Policy
- Printer and shared folder access verified
- Phone system setup (Teams Phone extension, auto-attendant presence)
First Month
- Access review: confirm they have what they need, nothing more
- Mandatory security awareness training completed
- Phishing simulation campaign includes them
- Backup verification: their OneDrive is syncing, critical data is protected
- Feedback loop: how did onboarding go, what was missing
Security Induction Content
- How to spot phishing (red flags, hover to check URLs)
- How to report suspicious emails (one-click report button)
- Acceptable use policy: what is and is not okay
- Data classification and handling basics
- Password manager demo
- MFA and passkey use
- What to do if device is lost, stolen, or compromised
- Who to contact in a suspected incident
Common Mistakes
HR tells IT the day of start
No time to prep. Day one is wasted on setup. Agree 5+ day lead time.
Giving admin rights by default
Least privilege from day one. Improve later if justified.
Skipping security induction
Mandatory. Every starter. No exceptions.
No temporary access pass
New starter struggles to set up MFA on a locked-down device. TAP removes the friction.
Copying access from "someone similar"
Access creep starts on day one. Start from zero, add what the role needs.
Automate Onboarding
We build automated onboarding workflows with Entra ID, Autopilot, Intune, and HR integration so new starters are productive on day one.