IT Pre-Onboarding Checklist: From Signed Offer to First Login
Gregg DavisUpdated 10 min read
The weeks between a signed offer and a new hire’s first day decide how that day goes. If the laptop is still in transit, the account isn’t ready or the password went to the wrong inbox, the new hire spends their first morning waiting on IT.
This checklist covers that window, from the moment HR records a signed offer to the new hire’s first login. For every IT onboarding task from day one to the end of the first month, see our IT onboarding checklist. For the HR side of the weeks before day one, such as paperwork and welcome messages, see our guide to pre-boarding employees.
What Pre-Onboarding Covers
Pre-onboarding is everything IT has to finish before a new hire can sign in for the first time. It starts with a trigger, a signed offer with a confirmed start date, and it ends with a working login.
In between, IT works to a fixed deadline with several steps it doesn’t control: a supplier’s delivery date, a courier, a new hire who has to be home to sign for a package. So the work is less about any single task than about timing. Start the slow tasks early, hold back the risky ones until the start date, and be ready when the date moves.
The Start Date Is Your Trigger
Everything on this checklist counts back from one date. Make sure it comes from one place.
Get the Handoff From HR, Not From an Email
Pre-onboarding should begin when HR records the hire, not when someone remembers to forward an email. The HR system holds the start date, job title, department, manager and location, and it’s where they’ll be corrected if they change. When IT works from a copy in an inbox, a correction in HR never reaches IT.
Agree with HR on the event that starts IT’s work. For most companies, it’s a signed offer and a completed new hire record. Our guide to HR and IT collaboration in onboarding covers how to set up that handoff.
What IT Needs From HR
Ask HR for these details in every new hire record:
- Legal name and preferred name, for the display name and email address
- Job title, department and manager, for groups and access
- Start date and, where it matters, start time and time zone
- Work location, and whether the new hire is on site, hybrid or remote
- A personal email address and phone number, to reach them before they have a company account
- A shipping address for remote hires
- Employment type, such as full-time, part-time, contractor or intern, and an end date for temporary staff
- Anything unusual the role needs, such as specialized software, hardware or accessibility equipment
Missing details are a common reason pre-onboarding stalls. Make these fields required in your HR system or intake form rather than chasing them by email.
Work Back From Your Lead Times
Once you have the start date, list every task that depends on someone outside IT and how long each one usually takes. Start the slowest ones first.
Equipment
A standard laptop you already have in stock can be ready in a day. Anything else depends on your supplier. A specific model, a high-spec machine for engineering or design work, a phone or accessibility equipment can take much longer to arrive.
A few habits keep equipment off the critical path:
- Standardize models. A short catalog of standard builds for each role is faster to order, image and support.
- Keep stock. A few standard laptops on the shelf cover short-notice hires and replace faulty units.
- Order on the trigger. Place the order the day HR records the hire, not the week before the start date.
- Check current lead times. Ask your supplier for lead times when you order, and plan from those rather than from what last quarter’s orders took.
Licenses and Third-Party Accounts
Check that you have a free seat in every paid app the role needs. Buying more licenses may need a purchase approval, and some vendors set up accounts on request, which adds days. License management tools show what you have free before you need it.
Device Preparation
Imaging a device by hand takes a technician’s time, so book it in. If you use zero-touch provisioning instead, with a tool such as Windows Autopilot, make sure the device is registered with your management service before it ships. Otherwise it won’t pick up your configuration when the new hire turns it on.
Either way, test each device before it leaves IT. Sign in with a test account, check that apps and security settings are in place, and install any pending updates.
Ship Equipment to Remote Hires
For remote hires, shipping is the step most likely to slip. Plan it like a delivery with a deadline.
- Confirm the address. Use the address in the HR record, and confirm it with the new hire if they’re moving for the job.
- Aim to arrive a few days early. That leaves time to deal with a lost parcel or a damaged device before the start date.
- Track it and require a signature. A laptop left on a doorstep is a laptop you may have to replace.
- Plan for international hires. Customs, import duties and power adapters add time and paperwork. Check them before you ship.
- Pack the basics. Include the charger, any peripherals and a printed quick-start card that explains how to turn the device on, connect to Wi-Fi and reach IT.
- Never ship credentials in the box. If the package goes astray, the device and the means to sign in to it shouldn’t be in the same place.
Tell the new hire when to expect the package and what to do if it hasn’t arrived. Our guide to remote employee onboarding covers the rest of the remote experience.
Create Accounts Early, Enable Them on the Start Date
Accounts are the opposite of equipment. You want them built early, but not usable until the first day.
Create the Account Before Day One
Create the user account as soon as the HR record is complete. That gives you time to place it in the right organizational unit, add its groups, set up the mailbox, assign licenses and grant access to role-specific apps. It also gives you time to catch a mistake, such as a misspelled name or the wrong department, before the new hire sees it. Our guide to Active Directory user provisioning walks through the account itself.
Keep It Disabled Until the Start Date
An account that exists before its owner arrives is an account nobody is watching. If it’s enabled and someone learns its password, they can use it, and their sign-ins look like the new hire’s.
So create the account disabled in Active Directory, or with sign-in blocked in Entra ID, and enable it on the start date. That also keeps a new hire out of company data until their employment begins.
Enabling accounts by hand on the morning of each start date is easy to forget, so schedule it. In Microsoft Entra ID Governance, Lifecycle Workflows can run tasks a set number of days before, or on, the date in a user’s employeeHireDate attribute, including enabling the account on the hire date. HR-driven provisioning tools can do the same from the start date in the HR record.
Deliver Credentials Securely
The new hire needs a way to sign in for the first time, and that first credential is the weakest point of the whole process.
- Use the personal email for instructions, not secrets. Before day one, the new hire has no company inbox. Send a welcome email to their personal address with their username, what to expect on day one and how to reach IT. Leave the password out.
- Send the credential separately. Share a temporary password through a different channel, such as a text message, a phone call or the hire’s manager on day one. Never put the username and password in the same message.
- Prefer a Temporary Access Pass. In Microsoft Entra ID, a Temporary Access Pass is a time-limited passcode, which can be single-use, that lets a new hire sign in and register a passkey or other sign-in method without knowing a password. Lifecycle Workflows can generate one before the start date and email it to the new hire’s manager.
- Force a change at first sign-in. If you use a temporary password, require the new hire to change it and enroll in multi-factor authentication the first time they sign in.
- Make it expire. Set the pass or temporary password to work from the start date, and for no longer than the new hire needs to finish setting up.
The Day Before: Test the First Login
The day before the start date, check that the first login will work:
- The account is enabled, or scheduled to enable, on the right date.
- Group memberships, the mailbox and licenses are in place.
- The device has arrived for a remote hire, or is on the desk for an on-site one.
- The credential has been delivered, or is ready to hand over.
- Someone in IT is free on the morning of day one to help with the first sign-in.
If something isn’t ready, tell the hiring manager now, not at 9 a.m. on day one.
When the Start Date Moves
Start dates change. A notice period runs long, a background check comes back late, a new hire asks for an extra week. A pre-onboarding process that only works when the date stands still will fail regularly.
Change the Date in One Place
The start date should change in the HR system first, and everything else should follow from there. If the account enablement, the credential and the shipping plan all key off the HR record, a moved date only has to be changed once. If each was scheduled by hand, someone has to find and move every one of them.
When the Date Moves Later
- Keep the account disabled, and move its enablement to the new date.
- Reissue any Temporary Access Pass or temporary password so it’s valid from the new date.
- If the device has already shipped, let it arrive. The new hire can’t sign in until the account is enabled.
- Tell everyone who was planning around the old date, such as the hiring manager and facilities.
When the Date Moves Earlier
Check what can’t be ready in time, which is usually equipment. A preconfigured loaner from stock can bridge the gap until the new hire’s own device arrives. Then move the account enablement and the credential to the new date.
When the Hire Falls Through
If an offer is withdrawn or a new hire never starts, treat it as an offboarding. Delete or disable the account, cancel any credential, reclaim licenses and arrange for equipment to come back. An unused account left behind is exactly the kind of orphaned account deprovisioning is meant to catch.
Automate Pre-Onboarding With ezOnboard
ezOnboard connects your HR system to Active Directory and Entra ID, so the HR record becomes the trigger for IT’s work.
When HR records a new hire, ezOnboard creates the user account and applies your rules for groups, licenses and mailboxes based on the employee’s role. Approved HR changes, such as a new title or department, are reflected in your directory without anyone retyping them, and every change is recorded for audit.
That takes account creation and access off your pre-onboarding checklist, so your team can focus on equipment, shipping and the first login.
Schedule a demo or check this ROI calculator to see how much you can save with ezOnboard.
FAQs About Pre-Onboarding Checklists
What is pre-onboarding?
Pre-onboarding is the work done between a signed offer and a new hire’s first day. For IT, that means ordering and preparing equipment, creating accounts and access, and delivering the credentials the new hire needs to sign in. HR handles the paperwork and the welcome.
When should IT start pre-onboarding?
As soon as HR records the hire with a confirmed start date. Start with the tasks that have the longest lead times, such as ordering equipment and shipping it to remote hires.
Should you create accounts before the start date?
Yes, but keep them disabled until the start date. Creating them early gives you time to set up groups, mailboxes and licenses and to fix mistakes. Enabling them only on the first day means nobody can use them before the new hire arrives.
How do you send login details to a new hire securely?
Send instructions and the username to their personal email, and the temporary password or Temporary Access Pass through a separate channel. Make the credential expire, and require a password change and MFA enrollment at first sign-in.
What should IT do if a start date changes?
Update the date in the HR system first, then move the account enablement and the credential to the new date. If the date moves earlier, bridge any equipment gap with a loaner. If the hire falls through, disable the account, reclaim licenses and recover the equipment.