Employee IT Onboarding & Offboarding Checklist

Why a Checklist Matters

New hires who spend their first morning waiting for a laptop get a poor first impression of the business. Leavers who keep access to email or files for weeks afterwards are a bigger problem: it’s one of the most common ways small businesses lose data, and under BC’s privacy law you’re responsible for protecting the personal information your business holds.

Neither needs to be complicated. The steps below are what we follow for Surrey businesses on Microsoft 365. Copy them into your own document, adjust for your systems, and use them every time.

Before Day One

1. Get the details earlyName, start date, job title, manager, which teams and shared mailboxes they need, and whether they work in the office, at home or both.
2. Create the accountMicrosoft 365 account with the right licence, added to the correct groups and Teams, with a temporary password shared securely.
3. Prepare the laptopEnrolled in Intune, encrypted, updated, with the standard apps. With Windows Autopilot it can ship straight to the new hire.
4. Set up accessLine-of-business software, shared folders in SharePoint, printers, phone extension and building access card.
5. Plan the first loginBook 20 minutes on day one to set up multi-factor sign-in on their phone with someone who can help.

Give IT at least three to five business days’ notice. A laptop that has to be ordered can take longer, so keep one or two spare, already enrolled, if you hire often.

On Day One

• Multi-factor sign-in set up and tested
• Password changed from the temporary one, ideally into a password manager
• Email, Teams, OneDrive and SharePoint open and working
• Printer, scanner and phone tested
• Shown how to get IT help and how to report a suspicious email
• Acceptable use and security basics explained in five minutes, not fifty pages

In the First Week

Check in once the new person has used their setup for a few days. A five-minute conversation is enough. Are they missing access to a folder or an app? Is their phone getting email? Has anyone shown them where files belong in SharePoint rather than on the desktop? Small fixes in week one save a lot of “I didn’t know” later. It’s also a good moment to confirm they know how to report a suspicious email, because new staff are a favourite target for phishing in their first weeks.

When Someone Leaves: the Last Day

Do these in order, at the time the person’s employment ends. For a planned departure, schedule them in advance with your IT provider.

1. Block sign-inBlock the Microsoft 365 account at the agreed time, so the person can’t sign in from any device.
2. Reset the password and sign out everywhereReset the password and revoke active sessions, so phones and browsers that were already signed in are logged out.
3. Remove sign-in methodsRemove their multi-factor sign-in methods and any app passwords.
4. Keep the mailboxConvert the mailbox to a shared mailbox, which needs no licence up to 50 GB, and give their manager access. Set an automatic reply if clients still write to them.
5. Hand over filesGive the manager access to their OneDrive before the account is deleted. By default, Microsoft keeps a deleted user’s OneDrive for 30 days.
6. Collect and wipe devicesCollect the laptop and phone, wipe them through Intune, and reassign or retire them in the asset list.
7. Change shared secretsChange any shared passwords they knew: Wi-Fi, alarm codes, shared accounts, vendor portals.
8. Remove everything elseLine-of-business software, third-party apps, building access, phone extension and distribution lists.
9. Remove the licenceOnce the mailbox is converted and files are handed over, remove the licence so you stop paying for it.

In the 30 Days After

• Confirm the manager has everything they need from the old mailbox and OneDrive
• Check sign-in logs for any attempted access to the old account
• Update your documentation, asset list and organization chart
• Delete the account once nothing more is needed, or keep it blocked if you must retain it

When Someone Changes Roles

Role changes are where access quietly piles up. When someone moves from accounting to sales, add the new access and remove the old, the same day. A quick review of who has access to what, once or twice a year, catches what was missed.

Make It Repeatable

The businesses that get this right have three things in common. A simple request form that HR or a manager fills in for every joiner and leaver. One person responsible for confirming each step is done. And tools that make the steps quick: Microsoft Intune to enrol and wipe devices, Windows Autopilot so laptops set themselves up, and groups in Microsoft 365 so access follows the role instead of being set up by hand.

Intune and Microsoft Entra ID P1 are included in Microsoft 365 Business Premium, not in Business Basic or Business Standard. If you’d like this run for you, it’s part of our device and user management service. Or call 604-359-5284 and we’ll look at your current process.

Questions

Related

• Managed IT vs hiring in-houseReal costs, with a calculator
• How to choose a managed IT providerQuestions and a contract checklist
• Outsourced IT departmentEverything IT, one monthly price
• Co-managed ITBack up your in-house IT person