onboarding-checklist.txt

New user onboarding checklist for MSPs

Every step of a new starter ticket, from the approval to the closing note. Copy it into your PSA as a ticket template or checklist.

A new starter ticket touches five or six systems: the PSA, Entra ID or on-prem AD, Exchange Online, Teams and SharePoint, the RMM, and the client's documentation. MSPs tell us a clean cloud-only onboarding takes 15 to 30 minutes, and a hybrid AD one can take two hours. Most of the rework comes from a step that got skipped, usually the usage location before the licence, or credentials sent to a mailbox the new user cannot open yet.

The checklist below runs in the order the work happens. Delete the lines a client does not use, and add their exceptions (naming convention, default groups, the approver list) to the client's documentation so the next tech follows the same list. For leavers, use the employee offboarding SOP.

Template: new user onboarding

1. Request and approval

  • Ticket logged against the right client company, with the requester as the contact
  • Requester is on the client's approver list (manager, HR, or owner); if the request came by email only, confirm by phone or in Teams before creating anything
  • Full name, preferred name, job title, department, manager, office, and start date recorded
  • Role template or a "same as" user named, plus any extra mailboxes, shared drives, or apps
  • Licence type confirmed and approved by the client, since it changes their bill
  • Hardware needed and ordered, with the delivery date noted on the ticket

2. Account and identity

  • Checked that no account already exists for this person or this username
  • User created in Entra ID, or in on-prem AD for hybrid tenants (then wait for Entra Connect to sync before continuing)
  • UPN and email follow the client's naming convention
  • Display name, job title, department, manager, office, and phone filled in
  • Usage location set (Microsoft 365 will not assign a licence without it)
  • Temporary password set, with a change required at first sign-in
  • Licence assigned from free seats; if none are free, a seat bought through the distributor with the client's approval
  • Security groups added to match the role or the "same as" user
  • No admin roles assigned unless approved on a separate ticket

3. MFA and security

  • User in the group that conditional access and MFA policies target
  • Temporary Access Pass issued for first sign-in, or MFA registration scheduled with the user
  • Password manager account or shared vault access created, if the client uses one
  • Enrolled in the client's security awareness training

4. Mailbox, Teams, and files

  • Mailbox provisioned after the licence landed (allow a few minutes)
  • Aliases added and distribution lists joined
  • Shared mailbox access granted (Full Access, Send As, or both, as requested)
  • Calendar delegate permissions set, if requested
  • Email signature applied
  • Added to the right Teams and channels
  • SharePoint site and shared drive access granted; OneDrive provisioned

5. Device

  • Device assigned and the asset tag recorded against the user
  • Enrolled in Intune through Autopilot, or imaged to the client's standard
  • RMM agent installed and the device placed under the right client and site
  • EDR or antivirus installed and reporting
  • BitLocker on, with the recovery key saved to Entra ID
  • Microsoft 365 apps and line-of-business apps installed; printers mapped

6. Other access

  • Accounts created in line-of-business apps, with licences confirmed
  • VPN or remote access set up, if needed
  • Phone system extension or Teams phone number assigned
  • Building access and anything client-owned passed to the client contact

7. Handover and closeout

  • Credentials sent to the manager through a one-time secret link, since the new user cannot open their own mailbox yet
  • First-day note for the user: change the password, register MFA, and how to raise a ticket
  • User, device, and licence recorded in IT Glue or Hudu
  • User added as a contact in the PSA
  • Every change listed in the ticket notes, time entry logged, ticket closed
  • First-week check-in scheduled with the user or manager

Rallied is an AI agent that resolves requests in your PSA, and it runs the Microsoft 365 steps on this list from the new starter ticket: account, licence, groups, shared mailbox, and credentials to the manager, with each planned change written on the ticket first. See Microsoft 365 automation, or read the MSP client onboarding checklist for bringing on a whole new client.