In this guide · 8 sections
Short answer
Before day one, create the account with only the access the role needs, prepare an encrypted, updated laptop enrolled in device management, and add the person to the password manager. On day one, set up MFA together, walk through the IT and AI-use rules, and get a signed acknowledgement.
Why IT onboarding needs a checklist
In a small business, onboarding is often done by whoever is free, from memory. That is how access piles up: the new marketing assistant gets the finance folder because the template account had it, or uses the old employee's mailbox because it was easier. Each shortcut is a risk you carry until someone notices.
CSA's Cyber Essentials mark covers several of these areas directly, including asset records, secure configuration, access control and staff awareness. A checklist is the simplest way to show those controls are applied to every person, not just the ones you remembered.
Onboarding and offboarding are two halves of the same process. Whatever you record when someone joins becomes the list of things to remove when they leave. Our employee offboarding IT checklist is the matching document.
The week before they start
Do the preparation before day one, so the first morning is about setting up MFA and explaining rules, not waiting for a laptop.
Get the details and the role in writing
Full name, start date, job title, manager, and which systems the role needs. HR or the hiring manager fills this in, not IT guessing.
Create a new account with least privilege
Create a fresh Microsoft 365 or Google Workspace account. Add only the groups, shared mailboxes and folders the role needs. No admin rights.
Assign the right licence
Pick the plan the role needs and note the cost. Do not reuse a former employee's account to save a licence.
Prepare the laptop
Update the operating system, turn on disk encryption (BitLocker or FileVault), install endpoint protection and enrol the device in management such as Intune.
Invite them to the password manager
Add them to the right shared vaults only, such as Marketing, not Finance.
Set up other app access
Accounting, CRM, booking tools, social media. Invite them with their own work email, never with a shared login.
If you use Microsoft 365, a Temporary Access Pass lets a new user sign in once and register MFA or a passkey without ever being given a password by email.
Day one: accounts, MFA and devices
Sit with the new hire for the first hour. Doing these steps together avoids the classic problem of someone using a personal phone number or skipping MFA because a prompt was confusing.
- First sign-in with a temporary password or access pass, then set a strong, unique password stored in the password manager;
- MFA registered on their phone with an authenticator app, or a passkey, and tested once;
- Laptop sign-in tested, encryption confirmed on, and updates set to automatic;
- Phone set up for work email through the Outlook or Gmail app; on personal phones, use a work profile so company data stays separate;
- Email signature applied from the company template;
- Shared mailboxes and calendars checked so they can see what they need, and nothing more.
Device management matters most for the bad days: a laptop left in a taxi can be locked or wiped remotely. Microsoft's Intune documentation covers enrolment for Windows, Mac, iPhone and Android. Our BYOD and device management guide explains what to do with staff-owned phones.
Rules to explain on the first day
Short rules explained in person stick better than a 20-page handbook. Cover these, then give them the written version to sign:
- Passwords: unique for every system, stored in the password manager, never shared on WhatsApp or in spreadsheets;
- MFA prompts: never approve a prompt you did not start, and report it;
- Payments: any request to change bank details or make an urgent transfer is confirmed by phone on a known number;
- Files: work files live in OneDrive, SharePoint or Google Drive, not on the desktop or a personal USB drive;
- AI tools: only approved tools, signed in with the work account, and no customer or staff personal data pasted in;
- Personal data: what the PDPA means for their role, and who the Data Protection Officer is;
- Reporting: who to tell about a lost device, a strange email or a mistake, with no blame for reporting.
If you have not written AI rules yet, our ChatGPT at work policy guide gives you a starting point.
First week: training and acknowledgement
By the end of the first week, the new hire should have done a short security awareness session, such as a phishing basics lesson, and signed an acknowledgement of your IT, acceptable use and data protection rules. Keep the signed copy with their HR file.
Then review access once. Ask the manager whether the new hire has everything they need and nothing they do not. Adding a missing folder is easy; removing access nobody remembers granting is not.
IT onboarding checklist (printable)
Copy this into your HR process. Tick each item and keep the record; it doubles as the offboarding list later.
New employee IT onboarding
A password manager makes several of these steps faster and safer. Our password manager guide compares Bitwarden and 1Password for small teams.
Do it yourself or get help?
For a team that hires a few people a year, the checklist above and an hour of preparation per hire is enough. It gets harder when laptops are not managed, accounts were set up inconsistently in the past, or nobody knows who has access to what.
Our Device Encryption and Management package (S$490) sets up Intune or Google endpoint management with encryption, screen lock and remote wipe for up to 10 devices, so each new laptop is ready in minutes. Microsoft 365 / Google Security Lockdown (S$590) enforces MFA and cleans up admin roles, and Security Awareness Training (S$390) includes a recorded walkthrough for new joiners.
Frequently asked questions
No. Create a new account for every person. If the new hire needs the old mailbox's history, convert it to a shared mailbox or give delegated access, and keep it under a clear owner. Reusing accounts mixes two people's activity, leaves old access and devices connected, and makes investigations and PDPA requests harder.
On their first day, before they start sending email or handling client files. Doing it in person means you can check they used an authenticator app or passkey on their own phone, not a shared device or personal number, and that they know never to approve prompts they did not start.
Usually not. Standard user accounts stop most malware from installing itself and prevent accidental changes. If someone needs a specific app, install it for them or approve it through device management. Keep admin rights for a small number of named people and use separate admin accounts for admin tasks.
It is possible, but riskier. Personal laptops may lack encryption, updates or protection, and you cannot easily remove company data when the person leaves. If you allow it, require device management enrolment or limit access to browser-only use of email and files, and write the rules into a BYOD policy staff sign.
A short acknowledgement that they have read and will follow your IT and acceptable use policy, your data protection policy and your rules for AI tools. It should cover passwords, MFA, payment verification, file storage and reporting incidents. Keep the signed copy on file and ask staff to re-acknowledge when the rules change.