What Should Be Prepared on a Device for a New Employee?

New-starter preparation is broader than placing a laptop on the desk. If the account, email, applications, file access, printers, and any required VPN access are not known in advance, the employee can spend the first hours waiting for basic access.

Preparation should start with the role. Department, working pattern, applications, and required data access all help define how the device should be set up.

Copying another employee's account may look quick, but it can also copy unnecessary access. Two people with the same job title do not necessarily need the same project or customer permissions.

Create an individual business identity, assign the required licence, and plan the first sign-in securely. A shared user account should not replace a named identity.

Group memberships, shared mailboxes, Teams or collaboration spaces, business applications, and VPN access may all have different owners. A single 'account created' checkbox should not be treated as proof that every required access path is ready.

MFA registration also belongs in the onboarding process. The employee should understand which method is used and how to get help if the phone or authentication method changes.

The Windows or macOS device should run a supported version and be able to receive security updates. Disk encryption, screen lock, and the organisation's endpoint-protection tools should be checked before handover.

Applications should come from trusted sources and match the user's licensing. Browsers, Office applications, communication tools, and role-specific software can be opened and tested rather than merely installed.

Recording the model, serial number, assigned user, warranty, and accessories saves a great deal of time later when there is a loss, failure, or employee departure.

The employee should receive more than a password. They should know how to recognise and approve MFA requests, lock the device, store business files in the approved location, and report suspicious email or a lost device.

A short walkthrough of real tasks can be more useful than a long policy document. The user can sign in, check email and calendar, open the required files, and confirm that they know how to request support.

Temporary passwords, recovery codes, or sensitive setup information should not be left in an open desktop note. A password-change requirement or secure delivery method is a better approach.

Some requirements are not visible in the original request and only appear once the employee begins real work. Missing applications or permissions can be corrected during a short follow-up.

The same review can reveal excessive access granted as a temporary workaround. A broad privilege opened for one task can be removed before it quietly becomes permanent.

The record also helps later with role changes and offboarding. If the device, licences, and access already assigned to the employee are known, the departure process does not need to be reconstructed from scratch.