New Employee IT Onboarding Checklist For Small Business

01

The Seven-Step New Starter Checklist

Use this checklist before the start date, then close any unfinished items with the employee on day one. The Australian Cyber Security Centre’s accounts-and-identities guidance supports individual accounts, limited access and staff access management.

• 1. Confirm the role and start date. Record the manager, work location, device needs, required applications and who can approve access.
• 2. Create a named account. Give the employee their own identity and the permissions needed for their work.
• 3. Prepare the device. Check ownership, updates, encryption where appropriate, endpoint protection, Wi-Fi or VPN needs and business software.
• 4. Set up email and MFA. Assign the right mailbox and licence, enrol the approved multifactor authentication method and plan a secure first sign-in.
• 5. Grant role-based access. Add the necessary files, calendars, applications and groups. Financial, HR and administrator access needs explicit approval.
• 6. Test the day-one tasks. Sign in, send and receive a test email, reach the correct files and complete one ordinary work task.
• 7. Record the handoff. Note what was granted, who approved it, what was tested and when to review access. Explain how to request help and report a suspicious message.

02

Before The Start Date: Decide What The Role Needs

Ask the hiring manager which customers or projects the person will work on, whether they handle payments or sensitive records, where they will work and which systems they must use. A bookkeeper, receptionist and field technician may all need email but need different file and administration rights.

Nominate an approver for each sensitive system. Record who approved access to a finance platform, client database or shared mailbox and what level was granted. Start with the narrowest useful access and expand it when the work shows a need. The ACSC describes this as the principle of least privilege and recommends avoiding routine administrator access for staff devices.

Confirm whether a suitable device and software licence already exist. A late licence purchase or unprepared laptop can cost a new starter their first morning. Record separately billable licences, hardware and project work when agreeing the setup scope.

03

Create The Account And Secure The First Sign-In

Give each person their own business account. Support, permissions and later changes are easier to trace than with a shared password. Microsoft’s user setup guidance covers account creation and licence assignment. Google’s new-user guidance also starts with a named account. Use the platforms and licences your business owns.

Set up MFA before relying on the account for normal work. The available Microsoft 365 approach depends on tenant configuration and licensing; Microsoft documents security defaults and Conditional Access. Use your organisation’s approved initial-sign-in and recovery process. Keep a permanent password and recovery code out of ordinary email, and teach staff how to recognise an unsolicited request for an MFA code.

For a team inbox, grant the employee access to the shared mailbox through their own identity. Microsoft 365 support can be scoped for account, mailbox and tenant administration; confirm third-party licences in the written plan.

04

Make The Device Ready For Work

Record the device asset or serial number and who owns it. Apply current supported updates, check protection and encryption where appropriate and install the applications the role needs. Verify the connection route before the first remote day. Use a standard user account for everyday work, with a controlled route for tasks that need higher privilege.

Test as the employee would: sign in, connect to the right network, open email, access a required shared file, print if the job needs it and reach their first business application. A successful ordinary task gives you a more useful acceptance check than a setting labelled “enabled”.

05

Check Access, Support And Recovery Together

Keep a short record of the employee’s groups, applications and shared folders. It becomes the future leaver checklist: when the person changes role or leaves, the business knows what to review or revoke. The ACSC guide recommends removing access when staff leave or change roles.

Explain what is backed up, who can request a restore and where the employee should save work. Check coverage for local folders and third-party applications. Write backup and recovery responsibilities into the support plan and periodically verify them.

Give the employee the support route, what information to provide and how to flag a suspicious sign-in or payment request. A short day-one explanation helps staff ask for the right assistance earlier.

06

Who Owns The Checklist?

For an occasional hire, the owner or office manager may coordinate setup with a trusted technician. As the team grows, define responsibilities: the manager approves the role and access; the IT provider prepares accounts and devices within the agreed scope; the employee confirms the day-one tasks work. One named person closes the loop and records unfinished items.

Ultra IT can help Sunshine Coast and Gympie businesses make this repeatable through a Managed IT fit review. Managed IT Core starts from $239 per month for monitoring and maintenance of up to five eligible devices. User setup, support labour, Microsoft 365 administration, licences, security and backup are scoped separately unless your written plan includes them. Tell us your team and device count and where setup gets stuck, and we can propose a practical next step.