Employee IT Onboarding Checklist for NZ Businesses

This guide gives New Zealand business owners and managers an employee IT onboarding checklist, a clear handover to IT, and the checks to complete when someone leaves. Use it alongside your wider staff induction, which covers contracts, policies and introductions.

When a new starter arrives to find no login, no laptop and nobody sure which systems they need, the cost is a lost first week and setup shortcuts that can stick. A planned request, approved access and a readiness check on the day make employee IT onboarding predictable.

What should an IT onboarding checklist cover?

A useful employee IT onboarding checklist records what the role needs, who approves it, who carries out the setup and how readiness will be checked. Some preparation can happen in parallel. First sign-in and authentication enrolment may need the new staff member to be present.

Each business should name its own owners for these employee IT onboarding stages and record any exceptions, such as a starter who needs temporary access to a system outside the usual role.

Accounts and licences

Every starter needs an individual account as part of employee IT onboarding, in Microsoft 365, Google Workspace or your other core systems, rather than a shared login. Assign the licences and applications the role has been approved for, not a copy of whatever the last person in the role held. Copying a colleague’s access is quick but can carry forward permissions the new person does not need.

Record what was granted as you go. That access record is what makes later role changes and departures accurate, and it is the practical side of good identity and access management.

Devices

During employee IT onboarding, record the device in your asset register before it is issued. Check that it runs supported software with current updates, encryption, management enrolment and the protection your business has agreed. Our guide to IT asset management covers keeping that record current.

Access and permissions

In employee IT onboarding, give access based on what the role requires, approved by the manager and the owner of each system. Least privilege limits what is exposed if an account is compromised. Where a role needs administrator rights or an exception, record who approved it and when it will be reviewed, rather than granting broad rights to get someone working faster.

Security introduction

A short introduction to how your business handles suspicious emails, passwords and reporting helps new staff before they have full access. New starters do not yet know what normal looks like, which makes them a useful target for impersonation. Ongoing security awareness training builds on that first briefing.

What should an employee IT onboarding request include?

A complete request lets IT start work without chasing details. Agree a short form or ticket template that HR or the hiring manager fills in for every starter, and treat the request as incomplete until each item is answered or marked as not needed.

• The person. Name, role, manager, start date and time, location, employment type and any known end date.
• The work. The business applications, shared folders, mailboxes and phone or communication tools the role needs.
• The equipment. Laptop, desktop, phone, peripherals and anything specialist, and whether existing equipment can be reissued.
• Exceptions. Any access outside the usual role, with the approver named.
• Approvals. Confirmation from the manager and system owners, and budget approval for new hardware or licences.

A complete request is also the start point for measuring employee IT onboarding, because it separates waiting for details from the setup work itself.

When should employee IT onboarding start?

Notify IT when the hire and start date are confirmed. Use the agreed lead time for your devices, licences and application approvals. Hardware supply, specialist software and a group of starters may need longer than a week. Flag a short-notice hire early so the manager can agree a safe temporary arrangement and any outstanding work.

A simple trigger works well. When HR or the hiring manager confirms a new hire, IT receives the role, start date and time, manager, location and any known end date, and the employee IT onboarding request begins. That single handover prevents IT finding out about a starter on the morning they arrive.

Who should own employee IT onboarding?

Name one coordinator to follow each employee IT onboarding request through to completion. The manager decides what the role needs, system owners approve access, and IT or the provider carries out the agreed setup. Outsourcing the technical work does not transfer the business’s authority to approve access or spending.

Without a named coordinator, steps fall between HR, the manager and IT. The coordinator does not need to do the work, only to make sure each stage has an owner and that outstanding items are followed up.

How should devices be prepared?

For employee IT onboarding, use a maintained configuration baseline covering settings, applications and protection, so each device is set up the same way. A cloned image is one way to deploy that baseline. Modern provisioning can apply policies and install applications automatically through device management, such as Microsoft Intune, which keeps the baseline current without rebuilding an image each time.

IT does not need to sign in to every application as the employee. Some configuration completes during the person’s first sign-in. Microsoft’s guide to Windows Autopilot user-driven mode describes devices shipped directly to staff, who sign in with their work account so the device can join the organisation, enrol in management and finish its setup.

Company phones and tablets used for work should be enrolled in mobile device management as part of employee IT onboarding, so company data on them can be protected and removed later. Where staff use personal phones, the agreed arrangement may be enrolment or app protection for supported work apps, which protects and removes company data inside those apps without managing the whole phone.

What should IT offboarding cover?

Agree the date and time access must end with the authorised manager or HR contact. Check the person’s current accounts, permissions, devices and responsibilities, including business apps that are not connected to the main company login.

Block sign-in and revoke active sessions using each service’s controls. Remove application and remote access, transfer ownership of shared work, and change any shared credentials the person may know. Check completion rather than assuming that disabling one account closes every route.

Recover company equipment and preserve any business data that needs to be retained before wiping a device or deleting accounts. Give authorised staff access to the work they need and confirm retention and licensing requirements before removing licences. For a personal device, follow the agreed process for removing business data rather than wiping the whole device.

Record completed actions and follow up anything outstanding. Removing access does not erase files someone has already copied, and different services may take different amounts of time to end access.

Why the current access record matters

Offboarding uses the current access and asset record, updated through role changes. The original starter list or a role template is not a complete record of everything someone may hold when they leave, because people pick up access, shared folders and devices over time. Keeping that record current is the link between employee IT onboarding and a reliable departure.

Microsoft treats these as separate steps in its guide to removing a former employee: preventing sign-in, saving mailbox content, giving another person access to files, removing the licence and deleting the account. Its guidance on revoking user access explains that existing sessions need separate action. Devices that are retired rather than reissued need data removed before disposal, which our guide to secure IT disposal covers.

Remote, seasonal and batch starters

How do you onboard remote or hybrid staff?

Remote employee IT onboarding starts the same way. Prepare the approved device and access, arrange delivery, and give clear first sign-in instructions and a contact for help. Allow for authentication enrolment and any setup that completes when the person connects. Check essential apps and a real task from their working location. Our guide to remote work IT covers the wider setup for staff working away from the office.

How do you handle several starters at once?

Role templates reduce repeated decisions in employee IT onboarding, but the work does not stay flat as headcount rises. Every starter still needs an individual identity, approval, licence, equipment allocation and completion check. Batch hiring also needs capacity planning, device supply and coordination of first sign-ins, so give IT the numbers and dates as early as you can.

For seasonal or fixed-term staff, set expiry or review dates for temporary access when it is granted. Confirm any change to an end date, and check each leaver individually at the end of the season rather than assuming a template covers what each person actually held.

In-house, outsourced or shared employee IT onboarding

A documented employee IT onboarding process can work internally, externally or through shared delivery. Compare skills, capacity, cover when people are away, agreed lead times and responsibility for exceptions. A provider does not automatically make the process consistent or secure; a clear request process and agreed responsibilities do.

If you use a provider, agree who requests a starter, which details they need, the lead time for routine and non-routine setups, what is included in the service and who handles exceptions. Our guide to outsourced IT support compares in-house, external and co-managed arrangements in more detail.

How do you measure whether employee IT onboarding is working?

Measure the time from a complete, approved request to readiness, not from the date someone said yes to a candidate. Track whether the required setup was ready by the agreed start, where delays occurred and which access or equipment issues were still open. Separate provider work from approval and supply delays, so each can be fixed by the right person.

Use first-week tickets to find avoidable employee IT onboarding faults, alongside the number of starters and their roles. Training questions and legitimate support requests are normal. A low ticket count alone can also mean staff did not report problems, so ask new starters and their managers what was missing.

Common employee IT onboarding mistakes

• Starting on the first day. Hardware, licences and approvals take time, so the request should start when the hire is confirmed.
• Copying another user’s access. Build access from the approved role and record exceptions.
• Shared or temporary logins. Shortcuts to get someone working can outlast the reason for them.
• No completion check. A request closed before the starter can do a real task leaves problems for the first week.
• An out-of-date access record. Role changes that are not recorded make offboarding incomplete.

Employee IT onboarding support from Exodesk

Exodesk can run employee IT onboarding and offboarding for your business as part of managed IT services, using a request process and lead times agreed with you. Your business confirms each role, approves access and spending, and tells us when someone joins, changes role or leaves. We carry out the agreed setup and removal and record what was done.

Exodesk has supported New Zealand businesses since 1989. Today, our Christchurch and Dunedin teams support businesses nationwide.

Contact us or call 0800 396 337 to talk about your onboarding process.