IT Onboarding Checklist for New Employees
An IT onboarding checklist for new employees: accounts, MFA, laptop, licences and first-day access, ready before day one. Start it from your HR tool.
- Typical schedule per new hire
- The checklist 5 sections, 23 items
- Variables
{{employee_name}}{{start_date}}{{role}}{{manager}} - Start from CI
Use this checklist for every new employee, from the moment the contract is signed until the end of their first week. It covers the IT part of onboarding: accounts, devices, licences and access. HR and the team lead usually run their own onboarding list alongside it.
Who owns it
IT, or whoever administers your identity provider, owns the run. The hiring manager confirms which systems and permissions the role needs. Start the run as soon as the contract is signed. Laptops need shipping time, and some licences need approval.
Common pitfalls
- Starting on the Friday before. Hardware delivery, shipping to a remote employee and licence approvals all take days. Start at least two weeks ahead.
- Copying another employee's permissions. "Give her what Tom has" also copies Tom's old project access and admin rights. Grant access by role or group, not by example.
- Sending passwords in the welcome email. Send the activation link to a personal address and share the temporary credential through a separate channel, or let the person set it on day one.
- MFA left for later. Enrol MFA during the first login, while someone can help. "Later" often means never.
- Nobody checks the first login. Book a short IT session on day one to confirm that every account actually works.
If your HR tool can call a webhook, start the run automatically when a hire is confirmed. The checklist then appears with the start date and role filled in, and IT does not depend on an email reaching the right person.
The checklist: IT setup for {{employee_name}}
After the contract is signed
-
Start date
{{start_date}}, role{{role}}and manager{{manager}}confirmed with HR -
Access needed for
{{role}}confirmed with{{manager}}Use a role-based access list if you have one. Note anything beyond the standard set and who approved it.
-
Laptop and accessories ordered or taken from stock
-
Delivery address confirmed for a remote employee optional
-
Licences that need budget approval requested
Accounts
-
Identity provider account created with the agreed username format
For example in Google Workspace, Entra ID or Okta. Use the legal or preferred name as agreed with HR.
-
Account added to the groups for
{{role}}, not copied from another employee -
Email, calendar and chat accounts active
-
Mailing lists and shared calendars added
-
Password manager account created and the team vaults shared
-
Accounts in role-specific apps created (CRM, ticketing, accounting, design tools)
-
Activation link sent to a personal address, with no password in the same message
Device
-
Laptop enrolled in MDM with disk encryption on
-
Operating system and apps updated to current versions
-
Endpoint protection and backup agent installed and reporting
-
Laptop recorded in the asset register against
{{employee_name}} -
Laptop shipped or ready at the desk before
{{start_date}}
First day
-
First login done together, and MFA enrolled on the account
Prefer an authenticator app or a security key over SMS.
-
Every account in the list tested with a real login
-
Security basics explained: phishing reports, lost-device process, where to get IT help
-
Building access badge or door code issued optional
End of first week
-
Open access requests from the first days resolved
-
{{manager}}confirms the new hire has everything needed to work
Checklist as Markdown
Start this checklist from your pipeline
When a hire is marked as signed in the HR system, POST /api/v1/runs with template "IT setup for {{employee_name}}" and start_date, role and manager.
curl -X POST https://runbook.metastic.ch/api/v1/runs \
-H "Authorization: Bearer $RUNBOOK_TOKEN" \
-H "Content-Type: application/json" \
-d '{"template": "IT setup for {{employee_name}}", "variables": {"employee_name": "…", "start_date": "…", "role": "…", "manager": "…"}}'Frequently asked questions
When should IT onboarding start?
Start as soon as the contract is signed, ideally two weeks or more before the start date. Ordering and shipping hardware is usually the slowest part. Accounts can be created a few days before, but keep them disabled until the start date.
What should be on a new employee IT checklist?
At a minimum: identity account and MFA, email and chat, role-based group access, a managed and encrypted laptop, password manager access and a security briefing. Add the role-specific apps your team uses. The template above gives a sensible base you can trim or extend.
How do I avoid giving new hires too much access?
Define access per role or group, and add people to groups rather than copying another person's permissions. Record any extra access with the name of the approver. A periodic access review then catches what drifted over time.
Updated