Employee onboarding access checklist: From approved role to first sign-in

An employee onboarding access checklist should show which apps a new hire needs, who approved each role, and how the team will verify access. Creating accounts is one step. The employee also needs to sign in, complete the required authentication setup, and perform the work their role allows.

Work backward from the employee's start time and timezone. Give each dependency an owner and leave time to resolve missing approvals, licenses, or accounts. Separate the checks you can complete before arrival from those that require the employee's first sign-in.

Schedule preparation before the start date, then verify sign-in and app access with the employee.

Confirm the employee record and start time

Use the approved source for new-hire information. If your HR system feeds the directory, confirm the record there before investigating downstream accounts. Microsoft's employee-lifecycle guidance describes this HR-driven approach, but your organization may use a different approved intake process.

Check the employee's name, manager, department or role, work email, and start date with timezone. Resolve missing or inconsistent fields before they drive account creation. Record who can approve a correction if the start date or manager changes.

Distinguish four outcomes in the checklist:

• Provisioning: the account has been created.
• Activation: the employee is allowed to use it from the approved time.
• Authentication setup: the employee has enrolled the sign-in and recovery methods required by policy.
• Authorization: the account has the approved permissions inside each app.

An account created early need not be usable early. Where the app supports it, prepare the account in a disabled or pending state and schedule activation separately. Entra lifecycle workflows, for example, can schedule tasks before, during, or after an event. If an app cannot separate creation from activation, record that limitation and agree when to create the account.

Turn the approved role into an app list

For each required app, name the app owner, approver, intended role, and resources the employee should reach. Add any license or purchasing dependency and the date it must be resolved.

Use the requirements of the job to choose permissions. Copying a colleague's account can also copy exceptions, temporary grants, or responsibilities the new hire will not have. A support role might need access to a help-desk queue and its documentation without needing billing administration.

Keep optional tools separate from the apps needed on day one. That makes an incomplete request easier to triage: a missing help-desk account may block the employee's work, while an optional reporting tool can wait for its approver. The manager and app owner should agree on that priority.

Check identifiers and existing accounts

Before creating a new account, check whether the person already has one from a previous contract, internship, or other relationship with the company. Record the approved action for that account and any work that must be preserved.

Ask how each app matches an incoming identity to an existing user. WorkOS's SSO documentation, for example, describes an application flow that checks stored identity identifiers before looking for an existing user with a matching email. That is a specific implementation pattern, not a guarantee about every SaaS app.

For the apps in your checklist, confirm:

• Which identifier the provisioning or sign-in integration uses.
• Whether an existing account uses a different email address.
• Who can approve linking, renaming, or retiring an account.
• How the app handles a later email change.

Do not merge accounts merely because their names look similar. Resolve uncertain matches through the approved identity and account-management process.

Choose the provisioning path per app

With just-in-time (JIT) provisioning, an app creates a user during the first successful single sign-on (SSO) flow. The app may also map role information supplied by the identity provider (IdP).

Pre-provisioning lets you inspect the account before the employee signs in. With JIT alone, you cannot confirm before that first sign-in that the app account exists or that the employee can reach the required resources. Neither path removes the need to check app permissions.

For a pre-provisioned app, record the account identifier, intended role, activation state, and any failed provisioning task. For a JIT app, confirm the approved IdP assignment and role mapping in advance, then mark account creation and effective access as awaiting first sign-in. Put a named owner on that follow-up.

Use a sanctioned test account to check an integration before the start date if needed. Do not test by sharing or using the new employee's credentials. Their first sign-in must demonstrate that their own authentication setup works.

For a broader explanation of user provisioning, see the user provisioning guide.

Plan authentication enrollment and recovery

Decide how the new hire will establish their first trusted sign-in. Use the onboarding method your organization has approved for its identity provider, and verify the recipient before delivering a temporary credential or enrollment link.

Microsoft Entra's Temporary Access Pass is one example: a time-limited passcode that can help a user enroll passwordless authentication methods. Its lifetime and other settings are specific to Entra. The checklist does not need to reproduce them, but it needs an owner who has checked the settings in use.

Record the delivery method, issue and expiry times, required enrollment steps, and who can help if enrollment fails. Keep secret values out of the ticket and its evidence attachments. Do not reuse a bootstrap credential across employees or send a permanent password as an onboarding shortcut.

Agree in advance what counts as completed authentication setup under company policy, including recovery. If the employee cannot finish before a temporary credential expires, use the approved reissue process and verify their identity again as required. Do not work around the delay by letting them use somebody else's account.

Verify useful access and record the result

Keep the evidence close to the request. A compact readiness record can cover both preparation and first-day checks:

For example, consider a support engineer starting at 09:00 in Lisbon. Before arrival, IT confirms the approved help-desk assignment and documentation access. At the start of work, the engineer completes sign-in and enrollment, opens the right queue, and performs an approved task on a test ticket. The app owner verifies the result. If the help-desk app uses JIT provisioning, its account is marked ready only after that flow succeeds. If sign-in works but the queue is unavailable, the app owner checks the role and asks IT to investigate any directory mapping that supplies it.

Route missing accounts, failed authentication, and missing permissions to the people who can resolve each problem.

If something fails, first distinguish the failure:

• No account or assignment: check the provisioning job or JIT setup.
• Cannot authenticate: check the sign-in method, enrollment, and identity-provider policy.
• Can sign in but cannot do the task: check the app role and resource permissions.

Record the symptom, affected app, owner, and next action. Entra workflow history, for example, shows a user's tasks and their statuses, including failed or unprocessed tasks. Use those results alongside app evidence rather than treating a completed workflow as proof that every app works.

Decide the exceptions before day one

If the start is delayed, check scheduled jobs and any access already enabled. Updating a date in the source record may not reverse work that has already run. Confirm the new activation plan with each affected owner.

For a no-show, define who confirms the situation and authorizes suspending access. For a duplicate account, resolve ownership and retained work before linking or retiring it. For incomplete authentication enrollment, keep the item open with a named support owner.

Close the checklist when the required access has been verified, or leave specific exceptions with owners and deadlines. The record should make it easy to see what the employee can use now and what still needs attention.