# New Employee IT Onboarding Checklist: Accounts, Devices and Access

> A practical IT onboarding checklist for a Microsoft 365 tenant: create the Entra ID account, assign groups and licences, prepare the device with Autopilot and issue a Temporary Access Pass.

Source: https://www.epifive.com/blog/new-employee-it-onboarding-checklist · Published 2026-10-25 · EpiFive

## Key takeaways

- Create the new user in the Entra admin center under Entra ID > Users with at least the User Administrator role, and set usage location, manager and group membership at the start.
- Give new hires access through groups rather than individual assignments, because groups can carry licences, apps and policies with them.
- Windows Autopilot lets a new PC become business-ready from its OEM Windows installation, with the user only connecting to a network and verifying credentials.
- A Temporary Access Pass is time-limited, shown only once, and lets the new hire register passwordless methods without a password being emailed.
- Run a first-day verification before the hire arrives, and keep the same checklist in reverse for offboarding.

A good IT onboarding process has five parts that you finish before the new hire's first morning: an identity in Microsoft Entra ID, group membership that carries licences and access, a device that configures itself, a safe first sign-in, and a short verification. This checklist walks through each part for a Microsoft 365 tenant, with the settings and portal paths as documented by Microsoft.

## Who this is for

This is for office managers, part-time administrators and IT staff who set up one or a few new employees at a time and want a repeatable list. By the end you will have a sequence to follow, a handover sheet to fill in, and a first-day test that tells you whether the account, device and access work together.

The steps assume a Microsoft 365 tenant with Microsoft Entra ID, Microsoft Intune for device management and Windows 11 laptops. If you use a different mix, the order still applies: identity first, access second, device third, first sign-in last.

## Timeline

| When | Task |
|---|---|
| Two weeks before | Collect the hire's start date, role, manager, location and device needs |
| One week before | Order or reserve the device and register it for Autopilot, if applicable |
| Three days before | Create the account, set properties, assign groups |
| Day before | Check licences, mailbox and device assignment; prepare the handover sheet |
| Start day | Issue the Temporary Access Pass, hand over the device, run the first-day checks |
| First week | Confirm access to everything the role needs; remove anything extra |

## Prerequisites

- An admin account with at least the User Administrator role for creating users. Microsoft's guidance is to use the role of least privilege for the task. Creating a user needs User Administrator, inviting a guest needs Guest Inviter, and assigning Microsoft Entra roles needs Privileged Role Administrator.
- A naming convention for user principal names and display names, so accounts look the same.
- Groups that represent your access bundles, for example a group per department and per shared resource. If you have not built these, see [group-based licensing in Microsoft 365](https://www.epifive.com/blog/group-based-licensing-microsoft-365).
- Intune and Autopilot configured for new Windows devices. The Autopilot overview notes that automatic enrollment into MDM services such as Intune requires a Microsoft Entra ID P1 or P2 subscription for configuration. Check your licensing before relying on it.

## Step 1: Collect the information

Before touching the admin center, write down what you need. A new-starter form with these fields saves repeated questions.

- Full name, preferred display name and personal contact for the pre-start message.
- Start date, job title, department, manager and work location.
- The country or region where they will work, because it becomes the usage location in the user properties.
- Applications and shared resources the role needs: shared mailboxes, Teams, SharePoint sites, line-of-business apps.
- Equipment: laptop, monitor, phone, security key.

## Step 2: Create the account in Entra ID

1. Sign in to the Microsoft Entra admin center at https://entra.microsoft.com as at least a User Administrator.
2. Browse to **Entra ID** > **Users**.
3. Select **New user** > **Create new user**.
4. On the **Basics** tab, enter the **User principal name** and domain, the **Display name** and the **Mail nickname** if it should differ. The **Password** is auto-generated by default. The **Account enabled** option is checked by default; you can uncheck it to create the account in advance without allowing sign-in, and enable it on the start date.
5. On the **Properties** tab, fill in the identity, job information (title, department, manager) and the **Settings** section with the user's global location. Job title, department and manager are what dynamic groups and approval flows often depend on, so complete them.
6. On the **Assignments** tab, add the groups the user needs. The wizard allows up to 20 groups or roles, and you can add more later. Do not assign admin roles to a new starter.
7. Select **Review + create**, then **Create**.

If you created the account with **Account enabled** unchecked, switch it on before the start day, or the new hire cannot sign in.

Hybrid environments differ. If your users come from on-premises Windows Server Active Directory, Microsoft's documentation says the account is created there and synchronised, and attributes such as identity, contact and job information must be updated in Active Directory and then wait for the next synchronisation cycle.

## Step 3: Licences and mailbox

A user needs a licence to use Exchange Online, Teams and other services. The simplest approach is group-based licensing: add the user to a group that carries the licence, and the assignment follows. The licence needs the user's usage location to be set, which is why you filled it in during creation. If it is missing you will see an error; the article on the [usage location error](https://www.epifive.com/blog/microsoft-365-license-usage-location-error) explains the fix.

After the licence applies, the mailbox is provisioned in Exchange Online. Allow some time for this to complete before you test mail. Then:

- Add the user to shared mailboxes and distribution lists they need. For the shared-resource decision, see [shared mailbox vs Microsoft 365 group](https://www.epifive.com/blog/shared-mailbox-vs-microsoft-365-group).
- Confirm the primary email address matches your convention.
- Add any alias addresses the role needs.

## Step 4: Prepare the device

Windows Autopilot is a collection of technologies used to set up and pre-configure new devices. It starts from the OEM-optimized Windows version preinstalled on the device instead of a custom image, then applies settings and policies, installs apps and can change the Windows edition. The documented features include automatic join to Microsoft Entra ID or hybrid join, auto-enrollment in MDM such as Intune, assignment to configuration groups from a device's profile, and a customised out-of-box experience. The user only connects to a network and verifies their credentials.

For each new laptop:

1. Register the device hardware identity for Autopilot, through your supplier or by uploading the hardware hash, according to your process.
2. Make sure the device is in the group that targets your Autopilot deployment profile.
3. Assign the apps and policies your standard laptop needs. The guides on [Autopilot deployment](https://www.epifive.com/blog/intune-windows-autopilot-deployment-guide) and [BitLocker silent encryption](https://www.epifive.com/blog/bitlocker-silent-encryption-intune) cover two core pieces.
4. If the setup screen hangs, use [the Enrollment Status Page troubleshooting guide](https://www.epifive.com/blog/intune-enrollment-status-page-stuck).

Existing devices can be prepared for a new user with Windows Autopilot Reset, which Microsoft describes as useful in break/fix scenarios as well.

## Step 5: Plan the first sign-in

Do not email a password. A Temporary Access Pass (TAP) is a time-limited passcode, configurable for single or multiple uses, with which a user can sign in and register passwordless methods.

### Enable the policy once

1. Sign in as at least an Authentication Policy Administrator.
2. Browse to **Entra ID** > **Authentication methods** > **Policies** and select **Temporary Access Pass**.
3. Select **Enable**, choose which users or groups can use it, optionally select **Configure** to change the lifetime or length, then **Save**.

The documented defaults are a minimum lifetime of 1 hour, a maximum lifetime of 8 hours, a default lifetime of 1 hour, one-time use set to false and a length of 8 characters. Lifetimes can range from 10 to 43,200 minutes. Only users in scope of the policy can sign in with a TAP even though you can create one for anyone.

### Create the pass for each hire

1. Sign in as at least an Authentication Administrator.
2. Browse to **Entra ID** > **Users** and select the user.
3. Select **Authentication methods** > **Add authentication method** > **Temporary Access Pass**.
4. Set an activation time or duration and select **Add**.
5. Copy the value. Microsoft notes that you cannot view the value after you select **OK**.

Set the activation to start on the morning of day one. Each user can have only one TAP at a time, and a new one overrides the existing one.

The new hire opens https://mysignins.microsoft.com/security-info, enters their user name, then enters the TAP. During Microsoft Entra join setup, a user can also authenticate with a TAP to join the device and register Windows Hello for Business. If you enforce single-use passes and device setup takes more than 10 minutes, Microsoft says a second single-use TAP may be needed for passwordless registration. Hand over the pass in person or through a channel separate from the account name. See [Temporary Access Pass for passwordless onboarding](https://www.epifive.com/blog/temporary-access-pass-passwordless-onboarding) for the full flow.

## Step 6: First-day verification

Run these tests before the hire arrives, using a test account if possible, and again with the new hire on the day.

| Check | Expected result |
|---|---|
| Sign in with the TAP at the Security info page | Sign-in succeeds, user registers a method |
| Device completes Autopilot | Desktop reached, policies and apps present |
| Mailbox | Sends and receives, shared mailboxes appear |
| Teams and SharePoint | Correct teams and sites are visible |
| Printing and shared drives | Default printer and needed shares work |
| MFA | User has at least one registered method besides the TAP |
| Licences | Assigned licence shows as active in the admin center |

## Troubleshooting

- The user cannot sign in with a TAP. Confirm the user is in scope of the Temporary Access Pass policy and has a valid pass. If it is one-time use, make sure it was not already used.
- The message "Temporary Access Pass sign in was blocked due to User Credential Policy" appears. Check that the user is in scope, that the user does not have a multiuse TAP while the policy requires one-time passes, and that a one-time TAP was not already used.
- The error "Temporary Access Pass cannot be added to an external guest user" appears. The account is an external guest; only internal accounts can be issued a TAP.
- Settings changes do not show immediately. Microsoft notes it can take a few minutes for TAP changes to replicate, so wait before re-creating.
- Licence assignment fails. Check the usage location and that the licence group is applied.

## Handover sheet

Give the new hire a one-page sheet with the account name, how to sign in on day one, where to register authentication methods, how to reach the help desk and who to ask for each system. Do not write the TAP on it.

## Closing checklist

- Information collected, including usage location and manager.
- Account created with **Account enabled** set for the start date.
- Groups assigned; no admin roles.
- Licence applied and mailbox working.
- Device registered, in the right group, and tested through Autopilot.
- TAP policy enabled; pass created with day-one activation.
- First-day tests passed and noted.
- Offboarding steps ready: see [the user offboarding checklist](https://www.epifive.com/blog/microsoft-365-user-offboarding-checklist).

## References

- Create, invite and delete users in Microsoft Entra ID: https://learn.microsoft.com/en-us/entra/fundamentals/how-to-create-delete-users
- Overview of Windows Autopilot: https://learn.microsoft.com/en-us/autopilot/overview
- Configure a Temporary Access Pass: https://learn.microsoft.com/en-us/entra/identity/authentication/howto-authentication-temporary-access-pass

## Frequently asked questions

### What role do I need to create a new user in Microsoft Entra ID?

Microsoft documents User Administrator as the least privileged role for creating a new user. Assigning Microsoft Entra roles at the same time needs Privileged Role Administrator, so avoid giving new hires roles at creation.

### How do I give a new hire a first sign-in without sending a password?

Create a Temporary Access Pass on the user's Authentication methods page and give it to them through a separate channel. The user then signs in at the Security info page and registers their own methods. The pass is shown only once, when you create it.

### How many groups can I assign when I create a user?

The create-user wizard in the Entra admin center lets you assign up to 20 groups or roles at creation. You can add more assignments afterward on the user's page.

### Do I need an image for each laptop model?

Not when you use Windows Autopilot. It starts from the OEM-optimized Windows installation that comes on the device and applies settings, policies and apps to it, so you do not maintain custom images and drivers for each model.