Set up a new hire's accounts

The two ways this goes wrong are equal and opposite: an empty first day, and an account that quietly carries production access because it was cloned from whoever sat nearby. Working from a written role avoids both.

Before the start date

1. Get the role, the start date and the manager in writing. Not a chat message saying somebody is joining — the actual role, because everything below is derived from it.
2. Find the access list for that role. If there is not one, write it from the last person hired into the same role and get the manager to confirm it. Never clone an individual's access: individuals accumulate.
3. Create the identity first, in the identity provider, and let every other system come from it. An account created directly in a tool is one that survives offboarding.
4. Provision from the list, in this order: email and calendar, chat, the tracker and documents, then source control, then anything that touches production or money — which is usually nothing on day one and should be granted when it is first needed.
5. Do not grant admin anywhere by default, including in chat and the tracker. It is easier to add on request than to find later.

On the day

Check they can actually sign in to each thing, in a single pass, rather than discovering it one tool at a time through them. Send one message listing what they have, what they do not have yet and why, and who to ask.

Write down what you did

Record the list of what was granted against the person, with the date. This is what an access review reads later, and what an offboarding works from. An undocumented grant is the one that gets missed.

Stop and ask

• Before granting production access, payment access, or the ability to send email in the company's name — each of these is a named person's decision regardless of role.
• When the role has no access list and the manager is unavailable. Set up the ordinary things and say what is waiting.