AI-generated illustrative scene.
A new employee should be able to start work without borrowing someone else's login. When someone leaves, the business should know who receives their work, which access must end and what information must be preserved. Both outcomes depend on timely decisions by managers, HR and IT.
This employee IT onboarding and offboarding checklist gives San Diego businesses a practical starting point. Adapt it to your applications, device policies and operating hours. A checklist works best when every task has an owner and a clear completion record.
Start with one approved request
Create a single request that follows the employee through the process. Record the person's name, manager, role, work location, start or departure time, required applications and company equipment. Include a contact who can resolve questions before the deadline.
Keep sensitive employment details restricted. IT usually needs the authorized access instructions and timing, not the personal reasons behind a staffing decision. Agree on a separate urgent process for changes that cannot wait for the normal notice period.
Before a new employee starts
Approve access by job responsibility
Ask the manager to identify the tasks the person must perform. Translate those tasks into application and folder access. Copying every permission from an experienced colleague can carry over responsibilities that the new employee does not have.
Confirm the employee's name and company email format.
Approve required applications and the budget for their licenses.
Identify shared folders, mailboxes and team memberships.
Record any temporary access and its review date.
Identify the person who will demonstrate job-specific software.
For Microsoft 365, account creation and license assignment are related but distinct administrative tasks. Use Microsoft's user setup guidance to match the account and subscription to the approved work.
Prepare a device that is ready for work
Record the assigned computer and accessories in an equipment register. Have IT check operating-system updates, approved applications, endpoint protection and the business's device settings. Confirm how the employee receives initial access without placing reusable passwords in a widely shared document.
If the person works remotely, schedule delivery and setup support before their first meeting. Include a plan for identity verification, failed deliveries and missing equipment. A laptop arriving on time is only one part of readiness.
On the first day, test the actual workflow
Work through a short set of tasks with the employee: sign in, register approved authentication methods, open the required applications, locate the correct project files and contact support. Verify access using their own account.
Microsoft explains that employees register their MFA methods after the organization's administrator requires MFA. Available methods depend on the organization's configuration. Follow the company's approved setup process rather than improvising with a shared phone or another employee's account. See Microsoft's sign-in setup guidance.
Explain where work should be saved, how to report a suspicious message and what to do if a device is lost. Our employee cybersecurity training article can support that conversation.
Before a departure, decide who takes over the work
Ask the manager to identify active projects, important correspondence, shared resources and outside vendors that depend on the departing employee. Assign new business owners before the handoff becomes urgent. Review applications purchased outside the normal IT process as well as the main company login.
Prepare a written access-change schedule approved by the appropriate manager or HR contact. Include remote access, business applications, shared credentials, physical badges and vendor portals where relevant. Sensitive departures should use the organization's restricted coordination process.
At the agreed time, close access and preserve continuity
Authorized administrators should block access and revoke sessions using the appropriate controls for each system. Confirm how applications behave rather than assuming that changing one password signs the person out everywhere.
Microsoft's offboarding guidance separates access blocking, preservation of email and files, transfer of access, license changes and account deletion. Follow that sequence deliberately. Determine retention obligations and authorized access before removing licenses or deleting accounts; the effect depends on the service and configuration. See Microsoft's former-employee guidance.
Recover company equipment and document its condition. Do not wipe a device until required company data has been preserved and the action is authorized. Personal devices need an approach consistent with the company's device policy; removing managed business data and erasing an entire personal device are different actions.
Close the request with evidence
A final review should answer four questions: Were access changes completed? Can the new work owner reach the necessary information? Is equipment accounted for? Are remaining exceptions assigned to someone with a deadline?
Checkpoint: Timing and access approval
Responsible party: Authorized manager or HR
Checkpoint: Account and device actions
Responsible party: IT administrator
Checkpoint: Project and file handoff
Responsible party: Receiving business owner
Checkpoint: Final exception review
Responsible party: Request owner
A small change that prevents a bigger interruption
Imagine a hypothetical San Diego design firm hiring a project coordinator while another employee leaves. The manager identifies the shared proposal folder and customer mailbox in advance. IT prepares the new account, and the receiving manager confirms the handoff before the old account is retired. The value comes from coordinated ownership, not a longer checklist.
Want a more consistent process for your team? Contact SD Network Pro to discuss employee IT setup, access management and ongoing support needs.