Getting a new starter productive on day one, and making sure a leaver's access ends on their last day, both depend on a simple, repeatable checklist. Here is one you can adapt.
A new starter's first morning says a lot about a business. If their laptop is ready, they can sign in, their email works and they can find the files they need, they feel welcome and start contributing straight away. If they spend two days borrowing a colleague's login, the opposite happens, and the shortcuts taken to get them going often become permanent security holes. Leavers matter just as much. An account left active after someone has gone is an open door. A simple, repeatable IT checklist for joiners and leavers solves both problems.
In a small business, onboarding is usually done by whoever is free, from memory. That leads to inconsistent access, missing licences and, most often, too much access: "just give them the same as Sarah". Over time people collect permissions they no longer need. A checklist makes each step deliberate and gives you a record of what was done, which is useful for Cyber Essentials, insurers and UK GDPR.
Ask managers to tell IT about a new starter at least a week ahead, using a simple form that captures:
| Area | Task |
|---|---|
| Account | Create the Microsoft 365 account with a consistent naming format and correct job details |
| Licence | Assign the right Microsoft 365 licence for the role (see our plans comparison) |
| Groups | Add to role based security groups, Teams and distribution lists rather than copying another user |
| Shared mailboxes | Grant access to the shared mailboxes the role needs, such as accounts or info |
| Line of business apps | Create accounts in accounts, CRM, practice management or other systems |
| Device | Prepare a laptop or PC that is encrypted, fully updated, protected and enrolled in device management |
| Phone | Set up a phone extension, mobile app or handset and add them to call groups |
| Password manager | Invite them to the company password manager and share only the vaults they need |
| Day one: MFA | Help them set up multi factor authentication with the authenticator app on their first morning |
| Day one: induction | Explain how to get IT help, the acceptable use policy, where files live and how to spot phishing |
| Training | Enrol them in security awareness training within their first weeks |
| Record | Log the device, licences and access granted against their name |
Never send a password and username together in the same email, and avoid writing passwords on sticky notes taped to the new laptop. A temporary password that must be changed at first sign in, shared by phone or in person, is far safer. Our multi factor authentication guide explains why MFA should be in place from the first day.
Leavers are where most small businesses have gaps. The order matters: cut off access first, then deal with data, and only then delete accounts.
People who change roles within the business are often given new access without having old access removed. Treat a move as a mini leaver and joiner: remove the old role's groups and add the new ones.
It is also worth reviewing everyone's access at least once a year. Ask each manager to confirm who in their team should have access to which shared mailboxes, folders and systems, and remove anything that is no longer needed. Pay particular attention to administrator accounts, which should be limited to a small number of named people, and to any accounts belonging to contractors or suppliers that may have been forgotten once their work finished.
Once your process is consistent, much of it can be automated. Role based groups in Microsoft 365 mean adding someone to one group gives them the right Teams, mailboxes and folders. Device management tools such as Intune can set up a new laptop as soon as the user signs in. Tools like Power Automate can turn a new starter form into tasks for IT, HR and the manager.
We handle new starter and leaver setups every week for businesses in Sunderland and across the North East, including preparing devices, licences and access so people are ready on day one. If you would like to tidy up your process, see our managed IT support and Microsoft 365 services, or book a free IT review.
At least a week is sensible, especially if a new laptop needs to be ordered. That gives time to create accounts, assign licences and prepare the device so the person is ready on day one.
Block their sign in, reset their password and sign them out of all sessions at the agreed time. Then deal with their email and files before deleting the account.
No. Block sign in first, then move or convert their mailbox and OneDrive data. Microsoft gives you 30 days to restore a deleted user, after which data can be permanently lost.
It is quick but risky, because people collect access over time. Using role based groups gives each person what their role needs and nothing more.
Our guides are written by the team who support businesses across the North East every day. If anything here raises a question about your own setup, ask us.
Cyber security
Multi factor authentication is one of the most effective security steps a small business can take. Here is how the different methods compare and how to roll MFA out across Microsoft 365 without upsetting your team.
Backup and continuity
Microsoft keeps its service running, but protecting your emails and files is your job. Here is what the built in retention really covers, where it falls short and what a proper Microsoft 365 backup adds.
Productivity
AI assistants can save real time, but only if they are used with care. This guide covers data protection, what never to paste into an AI tool, tidying SharePoint permissions before Copilot, and a simple acceptable use policy.
Book a free, no obligation IT review. We will look at your setup, tell you honestly what needs attention and give you a clear fixed monthly price.
