Room1.08Floor 1 Help desk and devices
Employee IT onboarding and offboarding
New staff get a working laptop, accounts and access on their first morning. Leavers lose access the moment they go, their data is kept, and every licence comes back to you.
- Ready on day one
- Laptop set up before they arrive
- No access left behind
- A checklist for every leaver
Joiners, movers and leavers
Every person who works for you passes through three moments that matter to IT. They join, and need the right access on their first morning. They change roles, and need new access while losing the old. They leave, and every door they had needs to close at once. IT people call this joiners, movers and leavers.
In most small businesses, all three happen by memory. The new hire spends day one watching someone set up their laptop. The person promoted from sales to finance keeps access to both. The person who left in March still has a working login to the CRM in September. None of it is anyone’s fault. It is what happens without a process.
What it costs without a process
- New staff idle for their first day or two
- Access granted by copying someone else’s account, mistakes included
- Former employees with live access to email, files or banking portals
- Licences paid for months after the person has gone
- No record of who had access to what, when a client or insurer asks
What a process gives you
- A laptop, accounts and access ready before the person arrives
- Access decided by role, not by whoever set it up
- Every door closed at the moment someone leaves
- Licences reclaimed the same week
- A written trail for every change
Before day one
The work for a new starter happens in the week before they arrive. All we need is a short request from the hiring manager or HR, ideally five working days ahead.
One short request
Name, start date, job title, department, manager, office or remote, and anything unusual such as a second monitor or a specialist application. We provide a simple form so nothing is missed.
Access by role
The account is created in Microsoft Entra ID and placed in groups for the department and role. Those groups grant the licence, the Teams channels, the SharePoint sites and the shared mailboxes. With Microsoft 365 Business Premium, groups can fill themselves from the department field, so the person gets exactly what their role needs and nothing copied from someone else.
A laptop that builds itself
The laptop is registered with Windows Autopilot and, if it is going to the office, prepared in advance so apps are already installed. If the person works remotely, it ships straight to their home.
A safe first sign-in
Nobody’s first password is emailed or written on a sticky note. New staff get a Temporary Access Pass, a one-time code valid for a few hours, which they use on their first morning to set up MFA and their own sign-in. From then on, only they know it.
An example role map
A role map is a simple table that says who gets what. We build one with you, usually in an hour, and it becomes the rulebook for every new hire. This is what one looks like for a 30-person professional services firm.
| Role | Gets on day one | Needs manager approval |
|---|---|---|
| Everyone | Email, Teams, the company SharePoint site, the password manager, security awareness training | None |
| Client services | The client files site, the practice management system, the client services shared mailbox | Access to closed client files |
| Finance | The finance site, the accounting system, the accounts payable mailbox | Banking portals and payment approval rights |
| Managers | Their team’s sites and the management site | HR and payroll folders |
| Reception | The main phone line in Teams, the visitor calendar, the reception shared mailbox | None |
Role changes: the forgotten middle
Most businesses have some process for joiners and leavers. Almost none have one for movers. When someone moves from sales to operations, they are given the operations access and nobody removes the sales access.
After a few years, long-serving staff can reach almost everything. It is called privilege creep, and it is exactly what an attacker hopes to find when they steal one person’s password.
When the role map drives access, a move is simple. The person’s department changes, they leave one set of groups and join another, and the old access goes with the old role. Once a quarter we also send managers a short list of who can reach their team’s sites and systems, so anything out of place is caught by the people best placed to notice.
Leavers: closing every door
Offboarding is where the real risk sits. Disabling the account is only the first step. This is the checklist we work through for every leaver, and we record each step as it is done.
| Step | When | Why |
|---|---|---|
| Block sign-in and end every active session | The moment they leave | Disabling an account does not log out a phone or laptop that is already signed in. Revoking sessions does |
| Remove MFA methods and change the password | The same moment | Stops any saved sign-in from being reused |
| Convert the mailbox to a shared mailbox and set an auto-reply | The same day | The manager keeps access to past email, and clients are pointed to the right person |
| Give the manager access to the person’s OneDrive | The same day | Deleted users’ OneDrive files are kept for 30 days by default, unless retention is set longer |
| Wipe or reset company devices through Intune | When the device is returned, or remotely if it is not | Company data is removed and the laptop is ready for the next person |
| Change shared passwords they knew | The same week | Office Wi-Fi keys, shared accounts and anything in the shared password vault |
| Close accounts outside Microsoft 365 | The same week | CRM, banking, supplier portals and social media logins that do not use company sign-in |
| Remove the licence and reassign the phone number | Once data is secured | You stop paying for someone who is not there |
A shared mailbox under 50 GB needs no licence, so most leavers’ email can be kept indefinitely at no cost. Mailboxes under a legal hold are the exception and keep an appropriate licence.
Difficult and sensitive departures
When someone is being let go, timing matters. We agree the exact time with HR, and access is cut while the conversation is taking place, not the next morning. Nothing is visible to the person beforehand.
If there is any chance of a dispute, the account is not deleted. The mailbox is placed on hold, files are preserved, and sign-in logs are exported, so that if questions come up months later about what was taken or sent, the evidence still exists. We do this quietly and keep the record for your lawyer, should you need it.
Automating it as you grow
For most offices under 50 people, a clear request form and a checklist we follow every time is enough. Beyond that, parts of the process can run on their own.
A new hire entered in your HR system can trigger account creation. A leaving date can schedule the account to close at the end of the last day. Microsoft Entra ID Governance includes lifecycle workflows built for exactly this, licensed separately, and we help you decide when it earns its cost.
The laptop side relies on Microsoft Intune and Autopilot, the identity side on Active Directory and Entra ID, and new equipment arrives through our IT procurement service already registered.
Onboarding and offboarding work we quote
- Role map and access groups built for your businessFixed quote
- Onboarding and offboarding process with request formsFixed quote
- Leaver access review across all your systemsFixed quote
- Former employee accounts cleaned up and licences reclaimedFixed quote
- HR system connected to Entra ID lifecycle workflowsFixed quote
- New starter laptop prepared and deliveredFixed quote
Questions people ask
How much notice do you need for a new starter?
Five working days is ideal, which gives time to order a laptop if no spare is available and prepare it in advance. If a spare laptop is ready, we can usually have someone set up within one to two working days. Last-minute starts happen, and we will do what we can, but the first day is smoother with notice.
Can a remote employee get a laptop without coming to the office?
Yes. The laptop ships straight to their home already registered to your company. They connect it to the internet, sign in with their work account and a one-time access code, and their apps, settings and files install automatically.
How do new staff get their first password securely?
We use a Temporary Access Pass, a one-time code valid for a few hours, given to the person or their manager by phone or in person. They use it on their first morning to set up MFA and their own sign-in. No password is ever sent by email.
What happens to a leaver's email?
We convert the mailbox to a shared mailbox, set an automatic reply pointing to the right contact, and give the manager access. Shared mailboxes under 50 GB need no licence, so past email is kept without ongoing cost. Mailboxes on legal hold keep a licence.
How long is a leaver's OneDrive kept?
By default, Microsoft keeps a deleted user's OneDrive for 30 days, with the manager given access during that time. That window can be extended in the Microsoft 365 settings. We move anything the business needs into a SharePoint site before the account is removed.
Can you cut off access during a termination meeting?
Yes. We agree the time with HR beforehand, and sign-in is blocked and all sessions ended while the meeting takes place. Phones and laptops are signed out at the same time, and company data can be wiped remotely from devices that are not returned.
Do we have to keep paying for a leaver's licence?
Usually not. Once the mailbox is converted to a shared mailbox and the OneDrive files are secured, the licence can be removed and reassigned or dropped at the next renewal. Licences for leavers are one of the most common savings we find.
What if a leaver keeps their company laptop?
If the laptop is managed by Intune, we can wipe it remotely the next time it connects to the internet, and lock it to your company through Autopilot so it cannot simply be reset and reused. The account it relies on is already disabled, so it cannot reach company data.
Tell us what’s going on
Pick how urgent it is and leave a way to reach you. The help desk replies by phone or email. If work has stopped, call 647-812-3775 instead.
Something broken, or something to plan?
For anything urgent, call. A technician answers the emergency line 24/7. For everything else, open a ticket and tell us what is going on.