The first day and the last day
On her first day, the new colleague sits in front of a laptop without any access. And months after an employee left, his mailbox still works. I see both often in small businesses. One wastes time, the other is a security risk.
Two short checklists prevent both.
Onboarding: before the first day
About a week before:
- Prepare the device: laptop with current OS, encryption, antivirus and required software. Ideally via central device management, which makes it almost automatic.
- Create the account: personal email address, licence, groups for drives and Teams.
- Rights by role: only what the job needs. More rights later on request.
- Phone: extension, company phone or rules for personal devices.
Onboarding: the first day
- Set up sign-in together, including MFA and a password manager (how to)
- Short introduction: where are files, how to report problems, who to ask
- The key rules on phishing and data protection; 20 minutes is enough
- Signature on the IT policy and, where needed, a confidentiality undertaking
Offboarding: the last day
This is the trickier part. Ideally it's done on the last working day, or immediately in contentious departures.
- Disable the account, don't delete it straight away. Convert the mailbox to a shared one or set an auto-reply.
- Sign out all sessions and remove MFA devices.
- Change shared passwords the person knew: Wi-Fi, social media, supplier portals.
- Collect devices: laptop, phone, keys, tokens. Then wipe them securely.
- Hand over data: back up important files from personal OneDrive or drives.
- Check forwarding: no automatic forwarding to private addresses.
- Release the licence so you stop paying for it.
The forgotten accounts
Accounts outside central management are most often left open:
- Online banking and payment services
- Domain, hosting and website logins
- Company social media accounts
- Industry portals and supplier shops
- Trial accounts with software vendors
Keep a simple list of who has access to which external services. A team password manager does this along the way.
Retention and privacy
Mailboxes and files of former staff often contain private content. Decide in a policy beforehand whether private use is allowed and how long data is kept. Business records with retention duties belong in central storage anyway, not in a personal mailbox.
FAQ
Is device management worth it with five people? Often yes. A new laptop is ready quickly, and a lost device can be locked remotely.
Who is responsible? Ideally a fixed person in the business who triggers the checklists, and your IT provider for the technical work.
Conclusion
Two well-kept checklists save time on day one and close gaps on the last day. If you'd like this set up for your team, see Workplace & Microsoft 365.
