Who this is for
This is for the person who owns the first day for a new hire. At a small company that may be the founder, the office manager, or the one IT generalist who also handles laptops. At a mid-sized company it is a shared job between HR, IT, and the hiring manager. The IT onboarding checklist for new employees below is written for that shared job.
Use it when you hire full-time staff, contractors, or rehires. The same steps apply, but contractors may need a shorter access list and a clear end date. Remote hires need the device shipped and the account ready before the start date, not on the morning of day one. If your onboarding still runs on a chain of emails, this checklist gives you a record you can audit and repeat.
Before you begin
Pick one owner for the checklist and one place where it lives. A ticket in your service desk works better than a document on a shared drive because it has a status, a due date, and a history. Give every new hire a single ticket ID that HR, IT, and the manager can quote. If the ticket system can copy a template, build one template per role family, such as office, engineering, sales, and field.
Agree on the source of truth for the start date and the job title. HR owns that record, and IT should not start device prep until the offer is signed and the start date is confirmed. Write down the cutoff: for example, a standard laptop request goes to IT ten business days before the start date, and a remote setup goes out seven days before. Those numbers are your own service levels, not a rule from a vendor.
Set up the basic plumbing before you need it. That means an identity provider such as Microsoft Entra ID, Okta, or Google Workspace, an endpoint tool such as Intune, Jamf, or Kandji, and a password manager. Name the groups that grant access to shared mailboxes, drives, and internal apps. Decide who can approve admin access and who can approve finance or payroll access. The checklist should point to those approvers by role, not by a person's name.
The checklist
Run the checklist in order. The first items start when the offer is signed, and the last items close after the first week. Every item needs an owner and a date. If an item cannot be done, record why and set a new date in the same ticket.
Do not copy the last hire's access. Use a role profile that lists the systems the job needs, then add or remove from that baseline. The manager approves the access list before IT grants it. That one step prevents orphan accounts and surprise admin rights.
On day one, the new hire should sign in once and find the work waiting. Keep the first session short: how to use the password manager, how to report a phishing message, where to ask for help, and what to do if a device is lost. Put those links in the ticket and in the welcome message.
- Confirm the signed offer and start date in the HR system, then open one onboarding ticket that carries the employee ID.
- Choose the role profile and list the systems, groups, and data the job needs before anyone grants access.
- Create the identity account with the correct name, manager, department, and start date, and require multi-factor authentication at first sign-in.
- Assign a laptop and peripherals from stock, record the serial number and asset tag, and ship or stage the device before the start date.
- Enroll the device in mobile device management and apply the baseline: disk encryption, screen lock, updates, endpoint protection, and backup.
- Create email, calendar, chat, and file accounts, then add the new hire to the groups that grant shared mailbox and drive access.
- Grant application access through groups or roles, record the approver, and avoid direct permissions that no one reviews.
- Set up the password manager, share only the vaults the role needs, and show the new hire how to store and share a secret.
- Prepare phone, VPN, badge, desk, and Wi-Fi access, and test each one before the new hire arrives.
- Send a day one message with the support channel, first meeting time, device pickup or shipping details, and the name of the IT contact.
- Schedule security and data handling training in the first week, including how to report a suspicious email and who to call for a lost device.
- Book a 30-day access review with the manager, remove anything the role does not need, and attach the result to the ticket.
- Link the same record to the leaver process so the manager can trigger device return and access removal on the last day.
What good looks like
A good process is boring in the right way. The new hire signs in, the laptop works, and the manager can name the systems the person should reach. The ticket shows who approved each access grant and when the device was handed over. If someone asks for an audit trail, you can export it without rebuilding the story from email.
The asset register matches the devices in use. Shared passwords do not exist. Admin access is limited and reviewed. The new hire knows how to report a problem before the first real problem happens. These are signs that the checklist is operating, not a document on a shelf.
Watch for a few failure patterns. A start date that changes without the ticket changing, a laptop ordered after day one, access granted because someone copied a colleague, and a contractor account with no end date. Each one points to a missing owner or a missing field in the ticket.
What to do next
Start with one role family and one ticket template. Run a dry run with a real start date and check every handoff. Fix the template after the first hire, then expand to contractors and other roles.
Review the ticket after 30 days and again at 90 days. Ask the manager what access was missing and what access was never used. Remove the unused groups from the role profile. Keep the review short and attach it to the ticket so the next hire benefits.
You can build this in house or use a managed IT provider. A bundle that joins recruiting and IT onboarding is another option. Cloudverg's Hire and onboard bundle at $14,900/month is one option among others. Pick the path that fits your team, then run the checklist with the next hire.
Frequently asked questions
What should an IT onboarding checklist for new employees include?
It should cover the signed offer and start date, the role's access profile, identity and multi-factor setup, device prep and enrollment, application access with an approver, security training, and a 30-day access review. Each item needs an owner, a due date, and a place in one ticket. The checklist should also connect to the leaver process so access does not stay open.
Who owns IT onboarding?
HR owns the start date, role, and paperwork. IT owns accounts, devices, and access grants. The hiring manager owns the access list and confirms it at the 30-day review. Put those duties in the ticket template so they do not depend on memory.
When should IT start onboarding a new employee?
Start when the offer is signed and the start date is confirmed. Standard accounts and a laptop from stock need several business days, and a remote device shipment needs more. A custom device or a high-risk admin role should start earlier. The exact cutoff is your service level, so write it down and keep it in the ticket.