An IT onboarding checklist is the list of technical tasks that get a new employee ready to work: a configured device, the right accounts and access, security set up, and a clear way to get help. Most of it happens before day one. IT owns devices and accounts, the hiring manager decides what access the role needs, and the new hire completes first login, MFA setup and security training.
This guide covers the IT side of onboarding, task by task, with an owner and a deadline for each. For the HR, manager and team tasks, use our full employee onboarding checklist.
Key takeaways
- Start IT onboarding about ten working days before the start date, as soon as the offer is signed.
- Give access by role and only what the job needs (least privilege), then review it after 30 days.
- Turn on multi-factor authentication (MFA) for every account from the first login.
- Never send a device and its password together; share credentials through a separate, trusted channel.
- Measure day-one readiness: did the new hire have a working device and every account on the first morning?
IT onboarding checklist at a glance
"Start −10" means ten working days before the start date; "Day 30" means 30 days after it.
| Task | Owner | When |
|---|---|---|
| Confirm the role's devices, apps and access level | Manager + IT | Offer accepted |
| Order the laptop and any phone, monitor or peripherals | IT | Start −10 |
| Enrol the device in management and install security software | IT | Start −7 |
| Create the identity and SSO account; assign role-based app access | IT | Start −5 |
| Ship the device to remote hires (credentials sent separately) | IT | Start −5 |
| Send day-one IT instructions and the IT support contact | IT or HR | Start −2 |
| First login, password change and MFA enrolment | New hire with IT | Day 1, morning |
| Test email, chat, shared drives and role tools | New hire with IT | Day 1 |
| Acknowledge IT and security policies | New hire | Day 1 |
| Complete security awareness training | New hire | By day 5 |
| IT check-in: open issues and missing access | IT | Day 5–10 |
| Access review: remove temporary or unused access | Manager + IT | Day 30 |
Before day one: prepare devices and access
The more IT does before the start date, the more day one can be about people instead of tickets. This is the preboarding part of IT onboarding.
1. Confirm what the role needs
Agree with the hiring manager on the device, the software and the access level for the role. A sales hire needs the CRM; a developer needs code repositories and development tools. Writing this down as a role template means the next hire in the same role takes minutes, not hours.
2. Order and configure the device
- Order early: laptops and phones can take more than a week to arrive, so order at start −10.
- Enrol in device management: the UK National Cyber Security Centre recommends zero-touch enrolment, so devices enrol in management automatically the first time they are switched on.
- Install the basics: operating system updates, endpoint protection, disk encryption, a browser and the core office apps.
- Use unique admin passwords: give each device its own local administrator password rather than one shared password for every laptop.
- Tag and record: log the asset number and who it is assigned to, so you can recover it when the person leaves.
3. Create accounts and give the right access
Create one identity for the new hire and connect apps to it through single sign-on (SSO) wherever possible. Then add the role's apps, a process known as user provisioning:
- Email and calendar (for example Google Workspace or Microsoft 365)
- Chat and video (Slack, Microsoft Teams, Zoom)
- Shared drives and the internal knowledge base or intranet
- Role tools such as the CRM, project management, finance or design apps
- HR and payroll self-service in your HRIS
Follow the principle of least privilege: NIST defines it as granting each user the minimum system resources and authorizations they need to perform their function. Start with the role template, add exceptions only when the manager asks, and avoid copying another employee's access, which often includes years of extra permissions.
Turn on multi-factor authentication (MFA) for every account. CISA says MFA can make you much more secure, and that phishing-resistant MFA is the standard to aim for, although any MFA is better than none.
4. Send day-one IT instructions
Two or three days before the start date, send the new hire what they need to log in on the first morning: where the device is, how to sign in, how to set up MFA and who to contact if something fails. Do not send a device and its password in the same package or email; share temporary credentials through a separate, trusted channel and ask the new hire to change them at first login.
Day one: first login and a working setup
1. First login and MFA
Sit with the new hire, in person or on a video call, for the first login. They change the temporary password, enrol in MFA and confirm the device is connected to the right network or VPN.
2. Test the key systems
Check email, chat, calendar, shared drives and every role tool before the session ends. Fix missing access on the spot instead of waiting for a ticket.
3. Show how to get help
Explain how to raise an IT ticket, where the self-service help articles are and who to contact for urgent problems. A name and a channel work better than a generic inbox.
4. Cover security basics
Walk through the essentials: locking the screen, spotting phishing, reporting a lost device and handling customer or employee data. Ask the new hire to read and accept the acceptable use and security policies, and keep a record of the policy acknowledgment.
The first 30 days: training, check-ins and an access review
- Role tool training (week one): schedule short sessions for the specialised software the role depends on, and share recorded guides for later.
- Security awareness training (by day 5): phishing, social engineering, password managers, data privacy and how to report incidents. Repeat it at least once a year.
- IT check-in (day 5–10): ask what is still missing or slow. Most access gaps show up in the first two weeks.
- Access review (day 30): with the manager, remove temporary or unused access and confirm the rest still matches the role.
- Feedback: add one IT question to your new hire survey, such as "Did you have everything you needed to work by the end of day one?"
Example: role-based IT access bundles
Role bundles make provisioning fast and consistent. Adapt this example to your own tools.
| Role | Core for everyone | Role-specific access |
|---|---|---|
| Sales | Email, chat, video, shared drive, HRIS self-service | CRM, sales engagement tool, contract e-signature |
| Software engineer | Email, chat, video, shared drive, HRIS self-service | Code repository, issue tracker, cloud console (read-only at first) |
| Finance | Email, chat, video, shared drive, HRIS self-service | Accounting system, expense tool, bank portal (approval rights added later) |
| Customer support | Email, chat, video, shared drive, HRIS self-service | Help desk, knowledge base editor, CRM (view only) |
IT onboarding for remote and hybrid employees
- Ship the device so it arrives at least two working days before the start date, and confirm delivery.
- Use zero-touch enrolment so the device configures itself when the new hire signs in.
- Send credentials separately from the device, through a trusted channel.
- Hold the first login on a video call with IT.
- Check home network basics and set up VPN or secure access where your company uses it.
- Agree how equipment will come back if the person leaves.
For the people side of remote onboarding, see our guide to remote employee onboarding and the remote onboarding definition.
Common IT onboarding mistakes
- Starting on day one. Devices and accounts that are ordered on the first morning are not ready until day three.
- Copying a colleague's access. It is fast, but it hands out permissions the new hire does not need.
- Shipping the password with the laptop. If the package is lost or opened, both are exposed.
- Skipping MFA "for now". Accounts without MFA are the easiest to take over.
- No owner for each task. HR assumes IT ordered the laptop; IT is waiting for HR to confirm the start date.
- No access review. Temporary access granted in week one is still there a year later.
How to measure IT onboarding
- Day-one readiness rate: share of new hires with a working device and all core accounts by the first morning.
- Time to full access: days from the start date until the new hire has every tool the role needs.
- IT tickets in the first 30 days: a high number points to gaps in the role template.
- Access reviews completed on time: share of new hires whose access was reviewed at day 30.
For more onboarding measures, see 10 metrics to measure employee onboarding success.
IT onboarding and offboarding go together
Every account and device you give a new hire is one you will need to remove when they leave. Keeping the same list for both makes that easy. See the IT offboarding list in our employee offboarding guide.
Newployee's onboarding software assigns these IT tasks to the right people with due dates, sends reminders, and connects to your HRIS, SSO, Slack and Teams through integrations, so every laptop and account is ready on day one.
IT Onboarding Checklist: FAQ
IT onboarding is the part of employee onboarding that gets a new hire technically ready to work: a configured device, the right accounts and access, security such as MFA, and a clear way to get IT help. Most of it should be finished before the first day.
The role's device and app needs, device ordering and setup, account creation through SSO, role-based access, MFA, day-one login instructions, a first-login session, security training, an IT check-in in the first two weeks and an access review at day 30. Each task needs an owner and a deadline.
Start as soon as the offer is accepted, and order devices about ten working days before the start date. That leaves time for delivery, setup and shipping to remote hires, so the device and accounts are ready on the first morning.
IT owns devices, accounts and security setup. The hiring manager decides what the role needs and approves extra access. HR confirms the start date and triggers the process. The new hire completes first login, MFA enrolment, policy acknowledgments and security training.
Give access by role and only what the job needs, turn on MFA for every account, enrol devices in management with unique admin passwords, send credentials separately from devices, train new hires on phishing and review access after 30 days.
Ship a pre-configured device so it arrives at least two working days early, use zero-touch enrolment, send credentials through a separate channel, and run the first login with IT on a video call. Agree up front how the equipment will be returned if the person leaves.
Sources
- More than a Password: MFA makes accounts much more secure; phishing-resistant MFA is the standard to aim for. Cybersecurity and Infrastructure Security Agency (CISA).
- Least privilege (glossary): definition from NIST SP 800-53 Rev. 5. National Institute of Standards and Technology.
- Device security guidance: provisioning and distributing devices: zero-touch enrolment, unique local admin passwords, sending credentials separately. UK National Cyber Security Centre.
