Picture two first days. In one, the new hire sits at a bare desk while someone hunts for a spare laptop, IT gets a surprise call, and by 3 p.m. she has email but can’t reach the files. In the other, she sits down at 8:55 to a working machine, signs in with credentials that already exist, and spends the morning learning the job instead of watching a progress bar. Same company, same cost — the entire difference is a checklist that started one week earlier. Here it is.

The week before: everything that can be done early, is

The secret of great day-ones is that they’re mostly finished before the person arrives:

  • Accounts created — email, Microsoft 365/Google, and the line-of-business systems for their role, with MFA enrollment ready to complete on day one
  • Access assigned by role, not by cloning. The tempting shortcut — “just copy Bob’s permissions” — is how access sprawl compounds: Bob’s accumulated decade of exceptions becomes the template. Define what the role needs once; reuse it forever.
  • Hardware prepped — the machine ordered or pulled from stock (which requires having a stock policy: one spare per ~10 staff saves more first days than any other line in this article), imaged with your standard software, encrypted, enrolled in management, and updated — because nothing says welcome like two hours of Windows updates
  • The physical and peripheral layer — desk, monitors, phone extension, door access, and the license counts checked before day one, not discovered at sign-in
  • Distribution lists, shared calendars, and the team’s tools — the small memberships whose absence the new hire won’t know to report; they’ll just quietly miss meetings

The trigger that makes all this happen is procedural, not technical: HR notifies IT the day the offer is signed, on a standard form — name, start date, role, manager. When onboarding fails, it’s almost never IT being slow; it’s IT finding out Thursday about a Monday start.

Day one: an hour of setup, then out of the way

The person meets a working desk and completes the last mile with a human (or a genuinely clear guide): first sign-in and password set, MFA enrolled — not deferred, because “we’ll add MFA later” is a gap with a countdown attackers understand — a tour of where things live (files, tickets, who to call), and signatures on the acceptable use policy. Then the two security items that belong in week one, not month three:

Close the loop, then make it a system

End of week one, a two-minute check: everything working? anything missing? — because the gaps found now take minutes, and the ones found in month two have usually been worked around in ways nobody documents. Then log what was issued and granted: the hardware to the inventory, the access to their record — onboarding’s paperwork is what makes offboarding possible. The two checklists are mirror images, and the departure-day scramble to figure out what someone has is always an onboarding debt coming due.

Finally, template it: one written checklist with owners per item (HR triggers, IT executes, the manager verifies), reused for every hire — and its lighter sibling for contractors, whose access gets an expiration date at creation. If you work with a managed provider, this whole flow should be a standard request form with a committed turnaround — it’s built into our onboarding for exactly the reason this article exists: repeatable beats heroic, every Monday.

The bottom line

A first day that just works isn’t hospitality theater — it’s the visible surface of a system: early notice, role-based access, prepped hardware, day-one MFA, week-one security basics, and records that make the eventual departure clean. One page, run identically every time. The new hire experiences it as a company that has its act together — which, on this evidence, it does.