New Employee IT Onboarding Checklist: Accounts, Devices and Access

A good IT onboarding process has five parts that you finish before the new hire's first morning: an identity in Microsoft Entra ID, group membership that carries licences and access, a device that configures itself, a safe first sign-in, and a short verification. This checklist walks through each part for a Microsoft 365 tenant, with the settings and portal paths as documented by Microsoft.

Who this is for

This is for office managers, part-time administrators and IT staff who set up one or a few new employees at a time and want a repeatable list. By the end you will have a sequence to follow, a handover sheet to fill in, and a first-day test that tells you whether the account, device and access work together.

The steps assume a Microsoft 365 tenant with Microsoft Entra ID, Microsoft Intune for device management and Windows 11 laptops. If you use a different mix, the order still applies: identity first, access second, device third, first sign-in last.

Timeline

Prerequisites

• An admin account with at least the User Administrator role for creating users. Microsoft's guidance is to use the role of least privilege for the task. Creating a user needs User Administrator, inviting a guest needs Guest Inviter, and assigning Microsoft Entra roles needs Privileged Role Administrator.
• A naming convention for user principal names and display names, so accounts look the same.
• Groups that represent your access bundles, for example a group per department and per shared resource. If you have not built these, see group-based licensing in Microsoft 365.
• Intune and Autopilot configured for new Windows devices. The Autopilot overview notes that automatic enrollment into MDM services such as Intune requires a Microsoft Entra ID P1 or P2 subscription for configuration. Check your licensing before relying on it.

Step 1: Collect the information

Before touching the admin center, write down what you need. A new-starter form with these fields saves repeated questions.

• Full name, preferred display name and personal contact for the pre-start message.
• Start date, job title, department, manager and work location.
• The country or region where they will work, because it becomes the usage location in the user properties.
• Applications and shared resources the role needs: shared mailboxes, Teams, SharePoint sites, line-of-business apps.
• Equipment: laptop, monitor, phone, security key.

Step 2: Create the account in Entra ID

1. Sign in to the Microsoft Entra admin center at https://entra.microsoft.com as at least a User Administrator.
2. Browse to Entra ID > Users.
3. Select New user > Create new user.
4. On the Basics tab, enter the User principal name and domain, the Display name and the Mail nickname if it should differ. The Password is auto-generated by default. The Account enabled option is checked by default; you can uncheck it to create the account in advance without allowing sign-in, and enable it on the start date.
5. On the Properties tab, fill in the identity, job information (title, department, manager) and the Settings section with the user's global location. Job title, department and manager are what dynamic groups and approval flows often depend on, so complete them.
6. On the Assignments tab, add the groups the user needs. The wizard allows up to 20 groups or roles, and you can add more later. Do not assign admin roles to a new starter.
7. Select Review + create, then Create.

If you created the account with Account enabled unchecked, switch it on before the start day, or the new hire cannot sign in.

Hybrid environments differ. If your users come from on-premises Windows Server Active Directory, Microsoft's documentation says the account is created there and synchronised, and attributes such as identity, contact and job information must be updated in Active Directory and then wait for the next synchronisation cycle.

Step 3: Licences and mailbox

A user needs a licence to use Exchange Online, Teams and other services. The simplest approach is group-based licensing: add the user to a group that carries the licence, and the assignment follows. The licence needs the user's usage location to be set, which is why you filled it in during creation. If it is missing you will see an error; the article on the usage location error explains the fix.

After the licence applies, the mailbox is provisioned in Exchange Online. Allow some time for this to complete before you test mail. Then:

• Add the user to shared mailboxes and distribution lists they need. For the shared-resource decision, see shared mailbox vs Microsoft 365 group.
• Confirm the primary email address matches your convention.
• Add any alias addresses the role needs.

Step 4: Prepare the device

Windows Autopilot is a collection of technologies used to set up and pre-configure new devices. It starts from the OEM-optimized Windows version preinstalled on the device instead of a custom image, then applies settings and policies, installs apps and can change the Windows edition. The documented features include automatic join to Microsoft Entra ID or hybrid join, auto-enrollment in MDM such as Intune, assignment to configuration groups from a device's profile, and a customised out-of-box experience. The user only connects to a network and verifies their credentials.

For each new laptop:

1. Register the device hardware identity for Autopilot, through your supplier or by uploading the hardware hash, according to your process.
2. Make sure the device is in the group that targets your Autopilot deployment profile.
3. Assign the apps and policies your standard laptop needs. The guides on Autopilot deployment and BitLocker silent encryption cover two core pieces.
4. If the setup screen hangs, use the Enrollment Status Page troubleshooting guide.

Existing devices can be prepared for a new user with Windows Autopilot Reset, which Microsoft describes as useful in break/fix scenarios as well.

Step 5: Plan the first sign-in

Do not email a password. A Temporary Access Pass (TAP) is a time-limited passcode, configurable for single or multiple uses, with which a user can sign in and register passwordless methods.

Enable the policy once

1. Sign in as at least an Authentication Policy Administrator.
2. Browse to Entra ID > Authentication methods > Policies and select Temporary Access Pass.
3. Select Enable, choose which users or groups can use it, optionally select Configure to change the lifetime or length, then Save.

The documented defaults are a minimum lifetime of 1 hour, a maximum lifetime of 8 hours, a default lifetime of 1 hour, one-time use set to false and a length of 8 characters. Lifetimes can range from 10 to 43,200 minutes. Only users in scope of the policy can sign in with a TAP even though you can create one for anyone.

Create the pass for each hire

1. Sign in as at least an Authentication Administrator.
2. Browse to Entra ID > Users and select the user.
3. Select Authentication methods > Add authentication method > Temporary Access Pass.
4. Set an activation time or duration and select Add.
5. Copy the value. Microsoft notes that you cannot view the value after you select OK.

Set the activation to start on the morning of day one. Each user can have only one TAP at a time, and a new one overrides the existing one.

The new hire opens https://mysignins.microsoft.com/security-info, enters their user name, then enters the TAP. During Microsoft Entra join setup, a user can also authenticate with a TAP to join the device and register Windows Hello for Business. If you enforce single-use passes and device setup takes more than 10 minutes, Microsoft says a second single-use TAP may be needed for passwordless registration. Hand over the pass in person or through a channel separate from the account name. See Temporary Access Pass for passwordless onboarding for the full flow.

Step 6: First-day verification

Run these tests before the hire arrives, using a test account if possible, and again with the new hire on the day.

Troubleshooting

• The user cannot sign in with a TAP. Confirm the user is in scope of the Temporary Access Pass policy and has a valid pass. If it is one-time use, make sure it was not already used.
• The message "Temporary Access Pass sign in was blocked due to User Credential Policy" appears. Check that the user is in scope, that the user does not have a multiuse TAP while the policy requires one-time passes, and that a one-time TAP was not already used.
• The error "Temporary Access Pass cannot be added to an external guest user" appears. The account is an external guest; only internal accounts can be issued a TAP.
• Settings changes do not show immediately. Microsoft notes it can take a few minutes for TAP changes to replicate, so wait before re-creating.
• Licence assignment fails. Check the usage location and that the licence group is applied.

Handover sheet

Give the new hire a one-page sheet with the account name, how to sign in on day one, where to register authentication methods, how to reach the help desk and who to ask for each system. Do not write the TAP on it.

Closing checklist

• Information collected, including usage location and manager.
• Account created with Account enabled set for the start date.
• Groups assigned; no admin roles.
• Licence applied and mailbox working.
• Device registered, in the right group, and tested through Autopilot.
• TAP policy enabled; pass created with day-one activation.
• First-day tests passed and noted.
• Offboarding steps ready: see the user offboarding checklist.

References

• Create, invite and delete users in Microsoft Entra ID: https://learn.microsoft.com/en-us/entra/fundamentals/how-to-create-delete-users
• Overview of Windows Autopilot: https://learn.microsoft.com/en-us/autopilot/overview
• Configure a Temporary Access Pass: https://learn.microsoft.com/en-us/entra/identity/authentication/howto-authentication-temporary-access-pass