IT onboarding checklist: devices, accounts, and access for new hires

Onboarding is where an employee's equipment record begins. If the laptop handed over on day one is never recorded against the new hire, the trouble shows up months or years later, at offboarding, when nobody can say which devices to ask for back.

Most onboarding checklists are written for HR and treat IT as a single line: "set up laptop and accounts." That line hides most of the work and most of the mistakes: hardware ordered too late, access copied from a predecessor, a loaner that becomes permanent without anyone writing it down.

This guide sequences IT onboarding from the hire request to the end of the first week, with a copyable checklist and a handoff record. It goes deepest on the device handoff, because that is the step the rest of the employee lifecycle depends on.

The IT onboarding sequence

The order matters as much as the list. Hardware needs lead time, accounts depend on the role being confirmed, and the handoff is the only moment when the person, the device, and the record are all in the same place.

For a contractor, add the end date to the request and to the account, so access expires on its own if nobody remembers to remove it.

Start from a hire request

A request in a ticket or form beats a message in a hallway, because it can be checked. It should include:

• the person's legal and preferred names, and how to reach them before they start;
• the start date, time zone, and work location, or the shipping address for a remote hire;
• the role, department, and manager;
• the employment type, and an end date for contractors and temporary staff;
• the standard equipment for the role, plus any extras the manager has approved;
• the systems and shared resources the role needs.

Define standard packages by role, such as "office laptop kit" or "field technician kit," so requests name a package instead of listing items from memory. Packages make ordering predictable and make the equipment list easy to check at handoff.

Grant access by role, not by copying another person's account. Copying "whatever Sam has" carries over everything Sam accumulated, including access for projects that ended years ago. The principle of least privilege, as NIST defines it, is to give each person the minimum access needed for their work.

Prepare hardware before the start date

• Reserve or order early. Take the device from stock or order it as soon as the request arrives. A returned device can be reissued only after it has been wiped, checked, and recorded as available.
• Tag and record it. Put an asset tag on each device, record the serial number, model, and accessories, and assign the record to the new hire from their start date. A device that is set up but not recorded is how loaners disappear.
• Prepare it. Enroll it in your device management tool, confirm encryption is on, install updates and the standard apps, and test that it starts cleanly.
• Ship remote hires' equipment with tracking. Require a signature on delivery, record the tracking number, and ask the new hire to confirm the serial number when it arrives.

Create accounts and access by role

• Create the identity account and mailbox, assign licenses, and add the person to the groups for their role.
• Give access to shared drives, business applications, and any physical access, such as building badges and keys. A key log records who holds which key.
• Issue a temporary credential that expires, and plan to set up the password and multi-factor authentication with the person on day one. CISA recommends multi-factor authentication for every account that offers it.
• Set an end date on contractor and temporary accounts.
• Record which licenses and subscriptions were assigned, so they can be reassigned when the person leaves.

The day-one device handoff

This is the step most checklists skip, and the one offboarding depends on.

1. Match each item to its record. Hand over the devices and read the asset tag or serial number of each one against the assignment, together with the new hire.
2. Record the accessories. Chargers, docks, monitors, headsets, and phones go missing at offboarding because nobody wrote them down at onboarding.
3. Collect the acknowledgment. Have the person sign the acceptable use policy, with the devices they received listed by asset tag or serial number. The acceptable use policy template builds a policy with an acknowledgment section, and the company device policy guide covers device-only clauses.
4. Set up sign-in. Replace the temporary credential, set up multi-factor authentication and the password manager, and test email, chat, file access, and remote access.
5. Show them how to get help. Explain how to report a lost, stolen, or broken device, and how quickly.
6. Record the handoff. Note the date, who issued the equipment, and its condition.

"Received a laptop" is weak evidence. "Received laptop AC-000231, serial 5CG4301XYZ, with charger and dock, on November 3" is strong, and it turns the return step at offboarding into a checklist.

Copyable IT onboarding checklist

Before the start date

• Receive the hire request with start date, role, manager, location, and employment type.
• Confirm the equipment package and any approved extras.
• Reserve or order the hardware.
• Tag each device and record its serial number, model, and accessories.
• Assign the device records to the new hire from the start date.
• Enroll devices in device management, confirm encryption, and install updates and standard apps.
• Create the identity account and mailbox, assign licenses, and add role groups.
• Set an end date on contractor and temporary accounts.
• Arrange building access and keys.
• For remote hires, ship with tracking and signature on delivery.

On day one

• Match each device and accessory to its asset tag or serial number with the new hire.
• Collect the signed acceptable use policy acknowledgment, listing the devices issued.
• Replace the temporary credential and set up multi-factor authentication.
• Set up the password manager.
• Test email, chat, files, business applications, and remote access.
• Explain how to get help and how to report a lost or stolen device.
• Record the handoff date, who issued the equipment, and its condition.

In the first week

• Confirm the person can reach everything the role needs, and nothing it does not.
• Remove temporary or setup access.
• Check the recorded equipment list with the person and correct it.
• Return any loaner issued while equipment was on order, or record it as assigned.
• Attach the signed acknowledgment to the person's or device's record.
• Close the onboarding request with a note of anything outstanding and its owner.

New hire equipment record

Copy this table into the onboarding ticket or the approved working document, one row per item:

Keep the record with the person, not only in the ticket. Tickets get closed; the list of what someone holds has to stay current until they leave.

Common gaps

• The loaner that stays. A temporary device issued while the real one is on order becomes permanent without a record. Assign loaners like any other device, with a due date.
• Accessories nobody recorded. Docks and monitors often cost more to replace than people expect, and they are the items most often missing at offboarding.
• Access copied from a predecessor. It grants old permissions to a new person. Start from the role.
• Contractor accounts without end dates. They outlive the contract.
• Shipped equipment that was never confirmed. Without the new hire confirming the serial number, the record shows what was sent, not what arrived.
• Policies signed once and never matched to devices. The acknowledgment is only useful if it lists what the person received.

Connect onboarding to offboarding

Every item recorded at onboarding becomes a line on the employee offboarding checklist. The more accurate the record on day one, the shorter the return list is to build on the last day. Replacements and upgrades in between should update the same record, so the list stays true for the whole time the person is employed.

The IT asset lifecycle guide places onboarding within the full sequence from purchase to disposal, and what IT asset management covers explains the wider system of record.

Using AssetCenter for the device side

AssetCenter records which person holds each device and accessory, keeps every earlier assignment in the device's history, and lets you attach files such as the signed acknowledgment. Each person's record lists everything currently assigned to them, which is the list the offboarding checklist starts from.

The Microsoft Entra ID integration brings new hires into the people list from chosen directory groups, and the Apple Business import brings in Macs, iPhones, and iPads with their serial numbers. The IT inventory page covers the wider device record.

AssetCenter does not create accounts, assign permissions, or enroll devices in device management. Identity, access, and device configuration stay with your directory and device management tools.

Next step: run the checklist for the next new hire

Copy the checklist into your onboarding ticket template and use it for the next person who starts. Record each device against them at the handoff, attach the signed acknowledgment, and check the list with them before the end of the first week.

By Jeremy Francis

Founder & CEO, AssetCenter