No Ticket Needed

Appearance

6 min fix Updated 8 Aug 2026Beginner

By , IT support technician

Quick Answer

A week out, order the laptop and create the account in the Microsoft 365 Admin Center; days before, add the new hire to shared mailboxes and Teams; on day one, hand over the temporary password by phone or text — never email — and enroll MFA in the first hour.

How to Set Up a New Employee's IT Before Their First Day ​

Applies to: Microsoft 365 Business, Windows 11
Article Type: How-To
Last Updated: 2026-08-08

Summary ​

Late summer is hiring season, and a September start date arrives faster than the laptop does. This is the owner-side checklist, sequenced by lead time — what to order a week out, what to click days before, and what to hand over on the morning itself — so your new employee signs in once and everything works.

Before You Start ​

  • A Microsoft 365 Business subscription, signed in with the admin account you used to set it up.
  • A payment method on file — the account-creation wizard charges it if you have no spare license.
  • The new hire's start date at least a week out, plus a personal phone number for the password handoff.

Do you have an IT team? Then this is a ticket rather than a task — How to Request IT Setup for a New Hire has the two-week lead time and the template that gets it actioned in one round trip.

Instructions ​

1. Order the hardware a week ahead ​

Hardware lead time is the one part of onboarding you cannot compress, so it goes first.

  1. Order the laptop at least a week before the start date — courier delays and out-of-stock models are the one failure you cannot click your way out of. How to Choose and Set Up the Best Laptop for a Small Business covers what to buy.
  2. When it arrives, unbox it, plug it in, and power it on until the first Windows setup screen appears, then shut it down. A dead-on-arrival unit discovered now is a warranty swap; discovered on day one, it is a very public scramble.
  3. Stage the rest of the desk — charger, mouse, monitor and cable, headset. Whatever the role needs on day one goes on this week's order.

2. Create the account and assign a license ​

Creating the account is the ten-minute job that brings the new hire's email address, OneDrive, and app license into existence.

  1. Decide the email address before you open the admin center, and match the format your existing addresses use — mixing jsmith@ with jane.smith@ is a small mess you keep forever.
  2. Run the Add a user wizard in the Microsoft 365 Admin Center — How to Add or Remove Users in Microsoft 365 Admin Center walks through every screen, including the license step. Do it in the same week-out sitting as the hardware order; the few days of extra license cost buys slack for everything below.
  3. In the wizard's password step, leave Require this user to change their password when they first sign in checked, and store the temporary password somewhere private — you hand it over in step 5, by a route other than email.
  4. When the wizard finishes, the new name appears under Users > Active users. The email address is live from that moment: mail sent to it now waits in their inbox for day one.

3. Add them to groups, shared mailboxes, and Teams ​

Days before the start, granting access is what turns an empty account into that person's workspace.

  1. List what the role touches: shared mailboxes such as info@ or support@, Teams teams, and any group calendars or distribution lists. For a first hire, the list is whatever you use every day.
  2. For shared mailboxes: in the admin center, go to Teams & groups > Shared mailboxes, select the mailbox, and under Members click Edit, then Add members. Tick the new name and click Save — it now appears in the member list.
  3. For Teams: in Microsoft Teams, click the three dots (More options) beside the team name, choose Add member, type the new hire's name, and click Add.
  4. For everything else: back in the admin center under Teams & groups > Active teams & groups, open each group and add the new name on its Members tab.
  5. Grant all of this at least a day early — permissions take up to an hour to reach Outlook and Teams, which is why this is a days-before task and not a first-morning one.

4. Prepare the apps and the sign-in path ​

Choose between installing the apps yourself and preparing a guided self-install, because either one works and unprepared is the only wrong option.

Path A — you prepare the machine, so the apps are waiting:

  1. Power the laptop on, choose Set up for work or school at the Windows setup screen, and sign in with your own admin account.
  2. In Settings > Windows Update, click Check for updates and let everything finish, restarts included — first-boot updates can run an hour, and that hour belongs on your desk, not theirs.
  3. Go to office.com, sign in, click Install apps > Microsoft 365 apps, and run the installer. The desktop apps install for the whole machine; each person signs into them with their own account.
  4. On day one, the new hire selects Other user on the Windows sign-in screen and signs in with their new email address — Windows builds their own profile with the apps already in place.

Path B — they set it up themselves, with a guide:

  1. Leave the laptop at the first setup screen, and the day before, send them Understanding What to Do When You Get a New Computer — it walks a non-technical person from first sign-in to working apps.
  2. Budget their first hour for it, with you nearby for the password handoff and MFA enrollment below.

5. Hand over the password safely on day one ​

A password handoff is safe when the username and the password travel by different routes and the temporary password dies at first use.

  1. Give the temporary password in person, by phone, or by text — any route except the one carrying the username. An email holding both is a spare key taped to the door it opens.
  2. Have them sign in with the new address and the temporary password, on the laptop or at office.com. An Update your password screen appears at once — that forced change is the temporary password expiring, which is exactly what it is for.
  3. They choose their own password, and you never learn it. That is the correct end state: the owner holds admin rights, not other people's passwords.

6. Enroll them in MFA within the first hour ​

MFA enrollment belongs in the first hour because a mailbox with no second factor is the most attackable thing in a small business.

  1. Have them install the Microsoft Authenticator app on their phone — How to Use the Microsoft Authenticator App walks through linking it to the account.
  2. When sign-in shows a More information required prompt, that is the enrollment wizard — walk it through to the confirmation screen now rather than postponing it.
  3. While they are in there, add a backup method such as their phone number, so a lost phone is an inconvenience rather than a lockout — How to Understand MFA and Prevent Account Lockouts explains which backup methods to pick.

7. Hand over their own first-week checklist ​

Your part of onboarding ends with a handoff, because the personal setup that remains belongs to the new hire.

  1. Send them Understanding Your First Week of IT — What to Set Up and Why — the signature, calendar, and phone setup is their checklist, with the reasons attached.
  2. Check in at the end of day one, and ask what still feels broken while it is a two-minute fix instead of a habit.

All of this is about an hour of your time, spread across a week. That hour is what a smooth first day looks like from the other side of the desk: they open the laptop, sign in once, and everything is where it belongs — which tells your new hire more about how this business runs than the welcome speech does.

Troubleshooting ​

WARNING

Never put the username and the temporary password in the same email or message. If that message is forwarded, or the account it sits in is compromised, your new hire's mailbox is open before they have signed in once. Hand the password over by phone, text, or in person — a different route than the one carrying the username.

Symptom / ErrorPotential CauseSolution
New hire can't sign in on the first morningReplication delay or password typoNew accounts take up to 15 minutes to activate — one more reason to create them a week out. Re-read the temporary password from your note character by character; auto-generated passwords mix lookalikes such as O and 0.
No licenses available in the Add a user wizardEvery purchased license is assignedThe wizard offers to buy one on the spot. Before paying, check Billing > Licenses in the admin center — if a departed employee still holds one, free it up with the removal steps in How to Add or Remove Users in Microsoft 365 Admin Center and assign it to the new hire instead.
Shared mailbox missing from their OutlookPermission sync delayPermissions take up to an hour to reach Outlook. Have them restart Outlook after that hour; if it is still missing, confirm their name sits under Members for that mailbox in Teams & groups > Shared mailboxes.
Authenticator code rejected during MFA setupPhone clock out of syncWork through How to Fix Microsoft or Google Authenticator Not Working — a clock sync in the phone's settings fixes most rejected codes.