New starter IT setup: what to do before day one

The new person starts at nine. The laptop is under somebody's desk, still in its box, and the account gets created at ten past. By lunchtime they have watched Windows update twice, borrowed a colleague's login to read one document, and been given the Wi-Fi password on a sticky note.

Nobody thinks of that as a security incident. It is the start of several.

The work happens the week before, not the morning of

Almost everything that makes a first day go badly is a scheduling problem wearing a technical costume. Accounts take minutes. Licences take seconds. What takes time is a laptop arriving, and what takes longer is a laptop arriving with the right amount of memory in it.

So think backwards from the start date. Hardware ordered first, because it is the only step you cannot compress. Account, licence and group membership next, which can be done in an afternoon. The device registered for automatic setup at the point you buy it, not at the point you need it.

That last one is the piece small businesses skip, and it is the one that removes most of the work. Windows Autopilot takes the Windows installation the manufacturer already put on the machine and turns it into your machine, applying your settings and installing your applications, without anybody building an image or touching the laptop first. Microsoft's own summary of the user's part in it: the only interaction required from the end user is to connect to a network and to verify their credentials, and everything beyond that is automated.

The NCSC put it more plainly in their device security guidance. Zero-touch enrolment, they say, cuts down on administrator time required to enrol each device and the likelihood for mistakes, and they strongly recommend organisations use it. A sealed laptop can go straight to somebody's house and arrive configured.

There is a licensing catch worth knowing before you plan around it. Automatic enrolment into Intune needs Microsoft Entra ID P1, which Business Premium carries and Business Standard does not. If you are on Standard, this whole approach is closed to you until you move, which we went through in Business Standard versus Business Premium.

Multi-factor authentication now happens at the first sign-in

This one has changed and a lot of people have not noticed.

If your tenant runs on security defaults, which it does if it was created after 22 October 2019 and nobody turned them off, every user must register for multifactor authentication. There used to be a fortnight's grace to get around to it. Not any more. Microsoft's documentation carries the note in a box: starting 29 July 2024, new tenants and existing tenants have the 14-day grace period for users to register for MFA removed.

What that means on a Monday morning is that the new starter sits down, types their password, and is immediately asked to set up a second factor. Registration under security defaults goes through the Microsoft Authenticator app using notifications. Once they are registered they can use codes from other apps, but the registration itself expects that one.

So the question you have to answer before day one is which phone. If the business issues handsets, fine. If it does not, you are asking somebody on their first morning to install a work app on their personal phone, which is a conversation that should have happened at the offer stage and usually has not. The third option is a hardware security key, which costs somewhere between twenty and fifty pounds and belongs to the company. For a warehouse or a workshop where personal phones are not welcome on the floor anyway, keys are often the right answer and almost nobody thinks of them.

Security defaults do other things at the same time that occasionally catch a new starter out. Legacy authentication protocols are blocked outright, so an old mail client that speaks IMAP with a plain password will simply fail. That is the point of the setting, and it is why we argued for turning it on in the MFA piece. It is still surprising when it happens to the one person who brought their own laptop.

Assign the licence before the first sign-in, not after

A Microsoft 365 account with no licence on it is a mailbox that does not exist and a OneDrive that has never been created. The person can sign in. There is nothing behind it.

Licence first, then sign-in, and the licence should come from a group rather than being clicked on individually. Group-based licensing means the leaver process drops the seat as a side effect of removing the person from a group, which is one fewer thing to remember on the day somebody walks out. If you have never audited which seats are actually being used, that is its own exercise, and it usually pays for itself.

Do not copy the access of the person doing the same job

This is the instruction that gets given more than any other, usually in good faith, and it is where permission sprawl in a small business comes from.

The colleague you are copying has been there four years. In that time they covered for someone on maternity leave, helped with a stocktake, and were added to a folder for a tender in 2024 that came to nothing. All of it is still on their account. Copy it to the new person and you have doubled it. Do that six more times and nobody in the building can tell you who can see the payroll folder.

Access goes on groups. People go in groups. The question you want to answer in ten seconds is not what can this person see, which is hard, but which groups is this person in, which is easy. The same discipline is what makes the leaver process take ten minutes instead of a fortnight of guessing.

The new person almost certainly does not need to be an administrator of anything either. If part of their job genuinely involves changing settings, that is a second account, which is the argument we made at length in the piece on admin rights.

The shared mailbox is not a user, and should not be billed as one

Every small business has an info@ or an accounts@ or a bookings@. A surprising number of them are full user accounts with a licence, a password written down somewhere, and three people signing in as the same identity.

Microsoft's answer is a shared mailbox, and it costs nothing. It comes with a shared calendar, people reach it using their own accounts, and replies appear to come from the mailbox rather than from a person. Microsoft's documentation also notes that by default, every new shared mailbox has sign-in blocked, which is the right behaviour. There should be no credentials for anyone to steal.

There are exactly three cases where you do have to put an Exchange Online Plan 2 licence on one, and they are worth knowing so nobody is surprised by a bill. More than 50 GB of storage in use. In-place archiving turned on. A litigation hold applied. Otherwise it is free, and the per-user licence somebody has been paying for reception since 2023 can be handed to the new starter instead.

Encrypt the disk, and check the key left the building

BitLocker is the part everyone agrees with and almost nobody verifies.

Turning it on is easy. Intune can do it silently, without the user seeing anything, provided the machine meets the conditions: joined to Microsoft Entra ID, a TPM of version 1.2 or later, native UEFI rather than legacy BIOS, Secure Boot enabled, and the Windows Recovery Environment present and configured. Modern business laptops meet all of that. A four-year-old machine somebody found in a cupboard often does not, and silent encryption quietly fails on it.

The bit that matters is where the recovery key goes. A recovery key that only exists on the encrypted disk is not a recovery key, it is a decoration. Microsoft's setting is named with unusual bluntness: Store recovery information in Microsoft Entra ID before enabling BitLocker, set to Required. Once it is there, an administrator can read it from the admin centre and, if you leave the default alone, the user can fetch their own through the Company Portal without phoning anybody at half past seven in the morning. Every read is written to the audit log under Key Management, so you can see afterwards who looked.

Two traps in Microsoft's own documentation are worth repeating, because they only bite later. Entra ID holds a maximum of 200 recovery keys per device, and if you somehow reach that, silent encryption starts failing because the key backup fails first. And deleting the Intune object for an Entra-joined encrypted device removes the key protectors for the operating system volume, which leaves BitLocker suspended on a machine everybody believes is encrypted. Both of those are tidy-ups gone wrong rather than attacks, which is usually how this goes.

Write the machine down on the day it arrives

An asset register is not paperwork. It answers three questions you will eventually be asked under time pressure: how many machines do we have, how old are they, and is this one still under warranty.

The day a laptop is unboxed is the only day you will ever have the serial number, the model, the purchase date and the warranty position all in front of you at once. Write it down then. Our own managed clients get this maintained automatically in the portal, alongside the joiner and leaver checklist, because the two are the same record viewed from opposite ends.

The register is also what turns replacing machines from a shock into a line in a budget. If you know four laptops come out of warranty next March, you can plan for four laptops next March.

What is not an IT job

Some of what gets called onboarding is not ours, and we will say so plainly.

Right to work checks belong to the employer. They have to be done before employment begins, they have to follow the prescribed process to give you a statutory excuse, and the money is serious. Since 13 February 2024 the starting point for a civil penalty is 45,000 pounds per illegal worker for a first breach, and 60,000 for an employer found in breach again within three years. That is HR's job, or your solicitor's.

The employment contract is not ours either. Nor is the DBS check, the reference, or the decision about whether somebody may use their own phone for work. Alpha IT is not a law firm, is not anybody's data protection officer, and does not submit anything to a regulator on a client's behalf. We create the account once someone with the authority to do so has said yes.

Where the two halves meet is the acceptable use policy, and it is worth a sentence. Somebody has to hand the new person a document saying what the laptop may be used for, what happens to their mailbox when they leave, and which tools they may sign into with a work address. We can tell you what technically happens. Writing the policy is a business decision, and the question of which AI tools people may paste work into has made that more urgent than it was two years ago.

What it costs

All of these figures are on our pricing page and none of them are charged per event.

Managed IT is 50 pounds per user per month on Essential, 77 on Professional, 108 on Complete, excluding VAT, monthly with thirty days' notice and no minimum spend. Setting somebody up and taking them off again sits inside that. Microsoft 365 licences are resold at list price and billed alongside the contract, so there is no margin hidden in them. Hardware is supplied at cost plus 20%, quoted before anything is ordered. Work falling outside an agreement is 86 pounds an hour for contract clients, 126 with no agreement, and 167 out of hours with a two-hour minimum.

We do not charge per starter because it would turn onboarding into an event rather than a checklist, and a business hiring four people in a month should not be penalised for hiring well.

The short version

Order the laptop first, because that is the step with a lead time. Register it for automatic setup when you buy it rather than when you need it. Create the account, put it in groups, and let the groups carry the licence. Decide which phone or key is doing the second factor before the person arrives, because there is no grace period to hide behind any more. Confirm the disk encrypted and that the recovery key is somewhere other than the disk. Write the serial number down.

Then, on the morning, the new person signs in once and starts work. That is the whole aim, and it is achievable in a nine-person company without buying anything exotic.