Discuss your project

TOOLBOX · DOWNLOAD

IT onboarding from day one.

Onboarding decides whether accounts are set up cleanly, permissions are limited to what is needed and new colleagues work securely from the start. This checklist organizes onboarding into three phases: before the first working day, on the first day and in the first weeks. It is based on the modules ORP.2, ORP.3 and ORP.4 of the BSI IT-Grundschutz Compendium (IT baseline protection of the German Federal Office for Information Security) and on data secrecy under § 6 DSG (Austrian Data Protection Act). For Microsoft 365, it lists the steps from creating the user through the Temporary Access Pass to automation. It is the counterpart to the IT offboarding checklist.

Download PDF (7 pages)What Is Inside

Free PDF · Checklist

IT Onboarding: Checklist for New Employees Joining

Topic
IT Operations & Organization
Format
PDF, A4
Length
7 pages
Size
98 KB
Updated
Oct 25, 2026
Sources
9
Usage
Redistribution in unchanged form permitted
Read as a Web Page

WHO IT IS FOR

Who This
Is for.

Set up account, permissions, device, first sign-in, data secrecy and training in an orderly way, based on BSI IT-Grundschutz and the DSG, with the steps for Microsoft 365.

  • HR and people managers who prepare new hires
  • IT management and administrators of Microsoft 365 and Microsoft Entra ID
  • Managers who define tasks, permissions and onboarding

8 SECTIONS

What Is
Inside.

Every technical statement in the document names its source. The revision date appears on every page.
  • 01

    What must be settled when someone joins

    Onboarding, permissions as needed, commitment and training

  • 02

    The process at a glance

    Three phases until onboarding is complete, plus the case of a role change

  • 03

    Before the first working day

    Prepare account, permissions, device and contact person

  • 04

    On the first working day

    Brief, commit, sign in securely

  • 05

    In the first weeks

    Train, review permissions, complete onboarding

  • 06

    Steps in Microsoft 365

    Users, Temporary Access Pass, devices and automation

  • 07

    Role changes and external staff

    When tasks change or external people join the work

  • 08

    Who does what

    Responsibilities in onboarding

EXCERPT

On the first working day

  1. Brief

    Inform about applicable rules, instructions and procedures (ORP.2.A1); brief on the secure use of IT components and provide binding, understandable policies (ORP.3.A3).

  2. Commit and instruct

    Unless already bound by law, contractually oblige the person to transmit personal data only on instruction and to maintain data secrecy even after the employment ends; instruct them on transmission orders and the consequences of a breach (§ 6 paras. 2 and 3 DSG). Commit them to compliance with laws and internal rules (ORP.2.A14).

  3. Sign in securely for the first time

    For the first sign-in, issue a Temporary Access Pass that the person uses to set up their own sign-in methods. TOMORIS recommends not sending passwords by email and handing over the access pass in person or through a separate channel.

  4. Set up multifactor sign-in

    Have the person register an authenticator app or passkey. The MFA in Microsoft 365 checklist covers rollout and methods in detail.

  5. Hand over device and access means

    Hand over keys, smart cards and tokens and document the issue (ORP.4.A5 to A7), and the device as well (TOMORIS recommendation). Instruct the person to keep passwords secret (ORP.4.A8).

  6. Explain the reporting path

    Show how to report suspicious emails and security incidents and who the contact person is (TOMORIS recommendation).

Get the Full PDF

SOURCES

Supported
by Sources.

  1. BSI IT-Grundschutz Compendium, module ORP.2 Personnel (Edition 2023) (opens in a new tab)ORP.2.A1, A3, A4, A5, A7, A14, A15, accessed October 25, 2026
  2. BSI IT-Grundschutz Compendium, module ORP.3 Security Awareness and Training (Edition 2023) (opens in a new tab)ORP.3.A3, A6, accessed October 25, 2026
  3. BSI IT-Grundschutz Compendium, module ORP.4 Identity and Access Management (Edition 2023) (opens in a new tab)ORP.4.A1 to A3, A5 to A8, accessed October 25, 2026
  4. Datenschutzgesetz (DSG, Austrian Data Protection Act), version in force in the RIS (opens in a new tab)§ 6 data secrecy, accessed October 25, 2026
  5. Regulation (EU) 2016/679 (GDPR), German version on EUR-Lex (opens in a new tab)Art. 29 and Art. 32(4), accessed October 25, 2026
  6. Microsoft Learn: Configure Temporary Access Pass in Microsoft Entra ID (opens in a new tab)Purpose, policy, lifetime, one-time use, accessed October 25, 2026
  7. Microsoft Learn: Add users and assign licenses (opens in a new tab)Least-privileged roles, license assignment, accessed October 25, 2026
  8. Microsoft Learn: Windows Autopilot overview (opens in a new tab)Purpose; Entra ID P1 or P2 for Intune enrollment, accessed October 25, 2026
  9. Microsoft Learn: What are lifecycle workflows? (opens in a new tab)Phases, example, license requirements, accessed October 25, 2026

This checklist is a TOMORIS recommendation and does not replace advice on employment or data protection law. Adapt it to your business. Names, default values and licenses in Microsoft 365 can change; Microsoft’s current documentation and the DSG and GDPR as currently in force are authoritative.

TOOLBOX

Explore
Further.

IT OPERATIONS & ORGANIZATION

More on
This Topic.

More free PDFs about IT Operations & Organization.
All IT Operations & Organization Downloads

YOUR NEXT STEP

From Paper
to Practice.

We review with you what is already implemented in your environment and put the rest into practice: as a project with EXPERTS or as ongoing operations with GRID.

Discuss ImplementationAll Downloads