Ask the hiring manager what the new employee needs to do on day one. A realistic example might be joining a video meeting, opening a shared file, and sending a message from their work email. That short list gives IT a concrete way to prepare and gives the manager a way to tell whether the setup is ready.

Turn the day-one list into tasks you can test

Ask for three to five tasks, each with a pass condition anyone can check. "Teams access" cannot be tested; "join the 9:30 Monday project meeting from the laptop with the camera working" can. A week ahead if you can, ask the manager:

  • Which meeting will they join first, and who organizes it?
  • Which folder, shared drive or Teams channel holds their files?
  • Who will they email or message, inside and outside the organization?
  • Which business applications do they need, and who administers each?
  • Will they work in the office, at home or both, and will they print or scan?

Check the path through the work

Make sure the device can get online, the employee has the correct account, and someone can help them enroll in the organization's sign-in protections. Review access against the role. Give them the files, calendars, and tools they need, and document who can approve anything extra. For each task, confirm that:

  • The device has the approved applications, finished updates and restarts, and a working camera, microphone and printer.
  • The account has the role's license and group memberships, not access copied from a colleague.
  • Each meeting, folder and application is shared with the new account, ideally through a group it belongs to.
  • Anything outside the role has a named approver and an end date.

Microsoft 365 lets you add a user even when no licenses are available. Before testing, confirm the new account appears in neither the Unlicensed users view nor the Users with errors view, both in the Filter set list on the Active users page. Leave Roles, under Optional settings, closed unless the person will administer something, since Microsoft advises using roles with the fewest permissions.

In Google Workspace, create the account at least a day before you test it. Google says it can take up to 24 hours for its services to be available to a new user.

Rehearse with a test account instead of the employee's password

Use an authorized test account or an assisted first sign-in instead of asking for the employee's password. Signing in as the new user early backfires, because the first sign-in is usually where multifactor authentication gets set up, by whoever is at the keyboard. Microsoft removed the 14-day registration grace period from security defaults for new and existing tenants starting July 29, 2024, so an administrator who signs in early can end up registering their own phone on the employee's account. If you use Conditional Access instead of security defaults, check what your policies require at first sign-in.

Google Workspace has the opposite risk. When 2-Step Verification is enforced, a super administrator can use the New user enrollment period setting, under Security, then Authentication, then 2-step verification in the Admin console, to give new accounts 1 day to 6 months to enroll. Google says users can sign in with just their passwords during that period, so keep it short and finish enrollment in the first-day session.

Have the owner, or whoever runs IT, approve the test account. Give it the role's license and groups, protect it with multifactor authentication that IT holds, and disable it between uses. Test from a browser or a spare machine so the new laptop isn't set up under it.

The test account sees what the new hire will see, except anything shared only to the new hire's own address, so share through groups or add the test account to those invitations. One or two working days before the start date, use it to:

  • Join the first meeting and note whether you go straight in or wait in the lobby.
  • Open the shared folder from the link the manager will send, not from an admin view.
  • Send a message to the manager and to an outside address, and confirm a reply arrives.
  • Open each business application and confirm it shows the role's screens, not just a login page.

A standing test account uses one of your paid licenses. If you hire only once or twice a year, skip it and test each task with the employee in a longer first-day session.

Two problems a rehearsal catches

For someone joining a project team, getting online, opening the team's folder and joining its meeting tests the equipment, identity and access in one sequence. It also reveals details that a simple inventory can miss, such as an invitation sent to the wrong account or a file link restricted to another group.

An invitation can reach the wrong account when the organizer uses the personal address from the hiring process. In Teams, someone who opens the link without signing in to a work or school account counts as an anonymous participant. If your organization lets anonymous participants join at all, they wait in the lobby unless the meeting's Who can bypass the lobby option is set to Everyone. Under People who were invited, Microsoft says someone with the join link but not the invitation itself also waits. Ask the organizer to put the work address on the meeting series and check the setting in Meeting options.

Microsoft counts members of an invited distribution list of up to 10,000 users as invited, except in channel meetings, where only channel members invited directly bypass the lobby. If the series goes to a list, add the new account and the test account to it, and let the rehearsal show whether the meeting reaches the test account's calendar and opens without a wait. Google Meet's Restricted setting admits without knocking only guests on the Calendar event and people a host invites during the meeting, and the host can change it under Video call options in the event.

A restricted file link in Teams can trace back to a private channel. Microsoft says each private channel has its own SharePoint site, and that people in the parent team, and admins, don't have access unless they're also channel members. Only the private channel owner can add people, and they must already be members of the team, so add the new account to the team first. Team owners can see private channels they aren't in under Manage team, so ask one to list them before the start date.

Separate setup from the employee's first sign-in

Install approved applications and confirm the device is ready ahead of time. Leave personal sign-in steps, such as enrolling a work account in multifactor authentication, for a supported session with the employee, booked for the first hour of day one.

In Microsoft 365, Add a user has two options selected by default, Automatically create a password and Require this user to change their password when they first sign in. On the completion page, Print creates a hard copy or PDF of the credentials that you can share securely, for example in person. Google's Admin console offers Copy Password, or Preview And Send to email the account details to the user's secondary address or another address you choose. Email them no more than a day ahead, because the welcome message's password link expires in 48 hours, and once it lapses you have to reset the password.

For staff moving to passkeys or passwordless sign-in, a Temporary Access Pass from Microsoft Entra fits better than a printed password. It is a time-limited passcode, for one sign-in or several, that the user signs in with to register their own methods, and it doesn't replace their password. If the employee joins their new laptop to Microsoft Entra ID during Windows setup, they can use the pass there and set up Windows Hello for Business in the same sitting.

An administrator with at least the Authentication Policy Administrator role turns it on under Entra ID, then Authentication methods, then Policies, and picks which users and groups can use it. A pass can be created for anyone, but only users in the policy can sign in with one. Passes are issued from the user's Authentication methods page, under Add authentication method, by at least an Authentication Administrator, and each user can hold only one.

By default a pass lasts one hour, the policy maximum is eight hours, and both can be set from 10 minutes to 30 days. Note the value before you select OK, because it isn't shown again. A one-time pass gives the user 10 minutes after signing in to finish registering a passwordless method, so if Windows setup runs longer, Microsoft says they need a second pass for Windows Hello for Business.

Microsoft says the prompt can take a few minutes to appear after a pass is added, so create it early with a custom activation time for the session. If it still doesn't appear, check that the user is in the policy and that a one-time pass hasn't been used. During the session, have the employee:

  • Sign in on their work device with the temporary password or pass handed over in person.
  • Register their own sign-in method on their Security info page, which under security defaults means Microsoft Authenticator or another app that generates codes.
  • Sign out and back in with the new method to prove it works.
  • Delete any pass from their Security info page once the new method works.
  • Make a test call from the Teams desktop app, under Settings, then Devices, to check the speaker, microphone and camera.
  • Run the day-one tasks again under their own account.

Because the security defaults sign-in screen shows a number to enter in Authenticator, tell the new hire to deny and report any approval request they did not start. CISA recommends training users to report unknown or bulk confirmation requests, and having IT investigate denied ones.

In Google Workspace, the employee enrolls on the 2-Step Verification page of their Google Account, under Security & sign-in, where they also get backup codes. Those come in sets of 10, each code works once, and a new set makes the old one inactive.

Common mistakes and how to spot them

An administrator's phone on the new account won't show up in a rehearsal, so look for it. Until the employee registers something, the user's Authentication methods page in the Microsoft Entra admin center should show no phone or authenticator app unless IT added one on purpose. If you find one nobody meant to add, Require re-register MFA at the top of that page deletes the account's phone numbers, Microsoft Authenticator apps and software OATH tokens, and the user is asked to set up a new method at their next sign-in if needed.

Copied access shows up as groups, teams or shared folders the role's list doesn't mention, and sometimes as an admin role. The Filter set list on the Active users page has Global admins, User admins and Helpdesk admins views for spotting that. Reusing a departed employee's account is the same mistake on a larger scale, because it keeps its memberships, shares and registered sign-in methods, so create a new one.

Send the manager a short handoff

Before day one, tell the manager what is ready, what still needs the employee, and who to contact if something fails. Include:

  • Which day-one tasks passed the rehearsal.
  • Which steps still need the employee, with the session time and who runs it.
  • What is waiting on someone else, such as a private channel owner, with a name.
  • What temporary access was granted, who approved it and when it ends.
  • Who to contact on day one and how.

Check back after the first week

Schedule a check after their first week to remove temporary access and catch anything they still need. Ask what the employee could not reach and what temporary access is no longer needed. Then:

  • Remove shares and group memberships that were granted for a single task.
  • Confirm the sign-in method is registered and no pass or temporary password is still in use.
  • Remove the test account from the role's groups, teams and channels, or disable it.
  • Add what you found to the role's day-one list for the next hire.

Set end dates when you grant temporary access, so the check confirms removal instead of relying on memory. In Google Drive, work and school accounts can select the Down arrow next to a person's name in the Share menu, choose Add expiration and pick a date within one year, though for folders this works only for Viewer roles. The same menu has Remove access. In Teams, a private channel's owner removes people under Manage channel, on the Members tab, and Microsoft says anyone removed from the team is also removed from all of its private channels.

To confirm Google enrollment, Reporting, then User Reports, then Security in the Admin console shows each user's 2-Step Verification enrollment and enforcement status. Google notes the report data can be delayed up to 48 hours and points to a user's own security settings in the Admin console for real-time status. In Microsoft Entra, the user's Authentication methods page lists what they registered and shows when a pass expired.

What owners usually ask next

A remote start follows the same checklist. Ship the laptop early enough to confirm it arrived, run the first-day session by video, and hand over the temporary password or pass only once you can see or hear the employee.

An employee who won't use a personal phone needs an answer before day one. Under Microsoft's security defaults the options are Microsoft Authenticator or another code-generating app, so plan a company device that can run one. Google's 2-Step Verification Methods setting can be set to Only security key, but then users can't create their own backup codes and an administrator has to provide them.

For a phone lost in the first week, Microsoft says a Temporary Access Pass makes recovery easier, and that the old method should be removed afterward. In Google Workspace, an administrator with the User management privilege opens the user under Directory, then Users, then Security, then 2-step verification, and selects Get Backup Verification Codes. Only super administrators can do this for another administrator's account.

A worked example

Imagine a twelve-person architecture practice hiring a project coordinator who starts on a Monday. The principal lists three day-one tasks: join the 9:30 project review in Teams, open the drawings for two active projects, and email a client from the work address.

On Wednesday the office manager creates the account and adds it to the Projects team. It appears under Unlicensed users because the last license went to a summer intern, so she buys one and assigns it.

On Thursday the test account waits in the project review's lobby. The meeting uses People who were invited, and the invitation lists the coordinator's personal address but not the test account, so the principal swaps in the work address and adds the test account. One project's drawings sit in a private channel the test account cannot open, so the principal, who owns it, adds the coordinator and the test account. Friday's retry goes straight in and opens both projects.

Friday's handoff lists the three tasks as ready, an 8:30 Monday sign-in session, and one week of read access to a closed project's archive. The coordinator's Authentication methods page shows no phone or authenticator app yet, as it should.

On Monday the coordinator changes the printed temporary password, registers Microsoft Authenticator, signs back in with it, and joins the 9:30 meeting without waiting in the lobby. A test call catches the speaker set to the monitor instead of the headset. At the week-one check the archive access comes off, the test account leaves the channel and is disabled, and the plotter nobody listed goes onto the role's checklist.

What to do this week

  • Ask the manager behind your next start date for three to five day-one tasks.
  • Check Google's New user enrollment period, or whether security defaults are on and who Microsoft Entra's Temporary Access Pass policy includes.
  • Decide who can issue a Temporary Access Pass or Google backup codes, and how they will confirm who is asking.
  • Put the first-week check on the calendar along with the start date.

Where ALCO can help

ALCO's help desk service includes repeatable onboarding and offboarding procedures, and the help desk is staffed 24 hours a day, including holidays, with calls answered by a person. ALCO's Microsoft 365 service covers Exchange, Teams, SharePoint, Entra ID and Intune, and its Google Workspace service covers Gmail, Drive, Calendar and the admin console.

Sources