The ultimate IT onboarding checklist for modern enterprises

A step-by-step playbook for IT managers and sysadmins, covering everything from pre-boarding to 90-day follow-up.

Updated:

March 20, 2026

Authored by:

Sudarshan Bhandarkar
System Administrator @ Atomicwork

Mark has joined your sales team. First day, first hour, his laptop hasn't arrived, his email isn't active, and nobody told him how to raise a ticket. By noon, he's spent his entire first morning doing nothing productive. By the end of the week, he's decided this place isn't as organized as it looked in the interview.

I've seen this exact scenario play out thousands of times across companies that know what good onboarding looks like but haven't built the systems to make it happen reliably. The problem comes down to execution at scale.

This checklist is what I use at Atomicwork: the full onboarding journey from the moment a contract is signed to the 90-day mark, when a new hire should be working autonomously without IT's help.

1. Pre-boarding checklist (1–2 Weeks before start date)

IT onboarding that begins on day one is already late. The most effective programs start the moment an offer is accepted, and not when the new hire walks through the door (or logs in remotely). A well-executed pre-boarding phase eliminates first-day friction that's entirely preventable.

The goal is simple: when the hire shows up on day one, everything should already work.

💡Pro tip: Automated provisioning triggers directly from your HRIS. When an offer is accepted in Workday or BambooHR, a workflow can kick off the entire provisioning sequence: hardware request, account creation, license assignment without a single IT ticket being raised manually.

Why this matters: Manual provisioning creates unnecessary delays, IT overhead, and a poor first impression that's hard to undo.

2. Day-one IT setup checklist

Day one is a high-stakes moment. A broken setup, say, accounts that don't work, a laptop that isn't configured, or MFA that no one walked the new hire through is costly in two ways: it kills productivity immediately, and it signals organizational dysfunction. Obviously, neither is acceptable.

The day-one checklist is about confirming that everything provisioned in pre-boarding actually works, and that the new hire knows how to use what they've been given.

💡Pro tip: We use dynamic employee groups to auto-provision apps and devices based on role, department, and location. A sales engineer in Singapore gets a different configuration than a backend engineer in Bengaluru, automatically, with no manual differentiation required from IT.

Common pitfall: MFA is the most frequently skipped item on day-one checklists, especially when the new hire is remote and doing self-setup. Make enrollment mandatory before any other accounts are accessible.

3. First-week training & access verification

Getting someone logged in is the beginning of onboarding. The first week should confirm that the new hire can access every system their role requires, understands key workflows, and has had permissions audited against the least-privilege principle.

This is also when the first compliance and security training happens. It must be structured and tracked as part of their first five business days.

💡Pro tip: Share the full first-week training schedule on day one so nothing feels ad hoc. Transparency reduces anxiety for new hires and signals that the organization is well-run. When people know what's coming, they prepare better and resist less.

On least-privilege: Every user account should have only the access they need for their role, and nothing more. Over-provisioning is as dangerous as under-provisioning. A marketing manager with read access to the production database is a misconfigured account waiting to become a security incident.

4. BYOD & personal device requirements

Bring Your Own Device policies create real security risk when they're vague, inconsistently enforced, or rely on employee self-compliance. At the same time, a blanket 'no personal devices' policy is impractical for many organizations, especially remote-first ones.

The right approach: clear, documented standards with MDM enrollment as a non-negotiable prerequisite before any personal device touches corporate data.

Recommended tools: Intune (Microsoft Endpoint Manager) and Jamf are the leading MDM platforms for enterprise BYOD management.

5. Shadow IT prevention & approved tool policies

Shadow IT is the set of tools, apps, and services that employees use without IT's knowledge or approval. It's a real and growing problem in most organizations.

Effective shadow IT prevention requires a two-pronged approach: make approved tools genuinely frictionless to access, and clearly communicate why unapproved tools are a risk.

The four pillars of shadow IT prevention:

1. Approved tool catalog: Every new hire receives a clear, accessible catalog of approved tools organized by function: file sharing, project management, communication, design, analytics, development, and more.
2. Risk communication: During onboarding, explain the specific risks of unapproved tools: data leakage, compliance gaps, and no SSO or audit trail.
3. Frictionless provisioning: By integrating SSO and app management into a single platform, provisioning approved tools should be near-instant.
4. Lightweight request process: Employees should be able to propose new tools through a simple request workflow rather than adopting them silently.

6. AI tool governance guidelines

AI tool governance is the most frequently missing section of corporate onboarding programs right now.

7. Cybersecurity & compliance training

Security training that happens three months after someone starts is too late. All cybersecurity modules should be completed within the first five business days.

💡Pro tip: All cybersecurity training must be completed within the first five business days. Completion is tracked in the ITSM platform and flagged to the manager's dashboard if overdue.

8. Identity management integration

A fragmented identity architecture is the root cause of most provisioning delays, access review failures, and offboarding gaps.

9. 30/60/90-Day IT follow-up cadence

Onboarding must have a structured follow-up cadence. This ensures new hires are fully productive and that IT access remains appropriate as their role evolves.

Days 1–30

• Confirm all access and tools are working correctly
• Resolve any outstanding provisioning issues
• Verify cybersecurity training completion (5-day deadline)

Days 31–60

• Review tool utilization. Are they actively using what was provisioned?
• Identify IT skill development needs (tool training, advanced workflows)

Days 61–90

• Full autonomy assessment. Can they work without IT support for routine tasks?
• Administer formal IT onboarding satisfaction survey

💡Pro tip: Schedule these check-ins automatically in your ITSM platform. Set triggers at 30, 60, and 90 days from hire date to generate tasks, surveys, and access review requests.

10. Contractor & vendor onboarding

Contractors and vendors present a distinct set of IT risks. They often need scoped, time-limited access to internal systems without the full identity footprint of a full-time employee.

💡Pro tip: Never reuse a former contractor's account for a returning contractor. Always create a fresh identity. Reusing accounts breaks audit integrity and creates compliance exposure.

11. Measuring IT onboarding success

The mantra is: What gets measured gets improved.

Build it once. Run it every time.

IT onboarding done well is a repeatable system as it is automated, auditable, and continuously improved based on data. The investment in getting it right pays back every hire cycle in reduced IT overhead, lower time-to-productivity, and a materially better employee experience.