New Hire Starts Monday: What IT Needs Ready Before Day One

The new colleague walks in at nine. Their desk has either nothing on it, or an old laptop nobody knows the password for. The first two hours go to “we told IT, it’s on the way,” and you have paid someone to sit idle for half a day.

Usually this is not incompetence. The information just arrives late. HR knows the start date for weeks, but IT hears about it on Monday morning. The sequence below shows what should be ready before the person arrives.

First, the trigger: who tells IT, and when?

Before any technical list, answer this: when a hiring decision is made, who informs IT and through which channel? In many companies the honest answer is “nobody” or “someone sends an email.” Tie it to one form: name, department, manager, start date, which applications they need, whether a phone is issued.

The form should reach IT at least five working days before the start date. If a device has to be ordered, allow longer. No laptop in stock is the most common blocker we see.

One week before: account and licence

Creating the account takes five minutes. The real work is putting it in the right groups. Someone joining accounting gets ERP access, someone joining sales gets CRM access, and both come from a department template. Granting permissions one by one turns into a table a year later that nobody can explain.

What	When	Watch out for
Email account and licence	5 days before	Do not leave a sign-in-ready account sitting around before the start date
Department groups, shared folders	3 days before	Do not clone the previous person’s account; use a template group
Phone line, extension	3 days before	If you run Teams Phone, add the licence too
Printer, VPN, application access	2 days before	Only what the job needs
Device preparation	2 days before	Details below

There is a small trap with licences. Handing a leaver’s licence to the new hire looks like a saving on paper; if the old mailbox and files are still there, it gets messy. Give the new person a new account, and release the old licence only after that data has been handed over.

The device: manual setup or a ready profile?

Spending half a day installing software on every new laptop stops working somewhere past 20 users. If you run Microsoft 365 Business Premium, Intune and Windows Autopilot are already included. Autopilot takes the Windows image that ships on the device and applies your settings and apps on first boot, without re-imaging. Per Microsoft’s documentation, the only thing the user has to do is connect to a network and verify their identity. Automatic Intune enrolment needs Entra ID P1 or P2, which Business Premium covers.

Setting it up the first time takes a few hours. After that, unboxing a laptop and connecting it to the internet is enough. Even a company hiring three or four people a year earns it back once you count device swaps and reassignments.

One more thing: if you start installing on Monday morning, updates eat the first hour. Power the device on at least a day earlier and let it update.

How do you hand over the first password?

A password on paper, or an “initial123” sent over WhatsApp, is a security problem. Entra ID has a better way: the Temporary Access Pass. An admin generates a time-limited code, the employee uses it for their first sign-in, and registers their own authentication method (Authenticator or a passkey).

According to Microsoft’s documentation, the default lifetime is 1 hour, configurable from 10 minutes up to 30 days, and it can be single-use. One detail on single-use passes: registering a method after signing in must finish within 10 minutes, otherwise you need a second code. If you will be doing the phone setup together with the employee, a multi-use pass is easier.

Day one: a 30-minute welcome

Technical readiness is not the whole job. A short session is enough:

• Hand over the device and let them sign in with their own account.
• Set up multi-factor authentication while you are sitting next to them. Half an hour later nobody remembers.
• Show them the password manager or the company policy.
• Explain how to open a support request: which address, which phone number, how fast you respond.
• Tell them in one sentence where to forward a suspicious email.

Do not wait for these questions to come up in week one. New people hold back, and the person who clicks the bad link is more often than not someone in their first week.

Common questions

What if the start date changes?

If the account was activated a day early, no harm done. Better still, tie the sign-in-ready switch to the date instead of opening the account early and parking it. An unused account with a known password should not be left lying around.

What changes for a remote hire?

The device is shipped, and this is where Autopilot really pays off: the employee unboxes it at home, connects to the internet and everything installs itself. Pass on the temporary code by phone or video call, not by email.

How much IT effort does one new hire take?

With a ready profile, half an hour to an hour. With manual setup, half a day is easy to burn.

The mirror image comes a year later, when someone leaves and their access has to be closed. We covered the offboarding checklist separately. If your entry process is tidy, the exit is easy, because you already know who has access to what.

If you want to review your own onboarding process or set up a template, get in touch.