01
Find the right comparison user
Choose someone with the same job function, department, location, and access needs. Their setup is a reference, not an automatic template.
Everyday IT · New Users & Onboarding
Set up a new user without guessing.
A new hire usually needs more than an account and a password. The job is to reproduce the access their role requires, verify each layer, and avoid giving them more access than they should have. Use a known-good employee in the same role as your reference, then verify instead of blindly copying.
The quick answer
A reliable new-user setup follows the same basic path in most small and midsize Microsoft environments.
02
Create the identity in the right place
Determine whether the organization creates users in on-premises Active Directory, directly in Microsoft 365 / Entra ID, or through another identity workflow.
03
Assign groups, license and access
Match the role, not the person. Add only the groups, applications, mailbox access, SharePoint access, and license the employee actually needs.
04
Verify before calling it done
Confirm sign-in, mailbox creation, required group membership, file access, applications, MFA registration, and device readiness.
New employee setup checklist
Before touching the environment, collect enough information to know what you are building.
Identity
Who is the employee?
Confirm legal/display name, preferred username format, job title, department, manager, location, start date, and whether an account already exists.
Role
Who already does this job?
Ask for a current employee with the same role. This gives you a practical reference for groups, applications, shared resources, printers, and licensing.
Access
What do they actually need?
Identify file shares, SharePoint sites, shared mailboxes, distribution lists, line-of-business applications, VPN or remote access, printers, and any privileged access.
Device
Where will they work?
Confirm workstation or laptop assignment, office or remote location, docking needs, phone or mobile requirements, and whether the device is already prepared.
Step 1: Find a known-good comparison user
Copying a working role is often safer than inventing a configuration from memory, but only when the comparison user is actually comparable.
Good comparison
Same role, same location, same responsibilities
If the new employee is a Tampa paralegal, another Tampa paralegal is usually a better model than the office manager or a partner.
Bad comparison
Do not copy somebody just because they sit nearby
Long-term employees often accumulate extra groups and one-off permissions. Blindly duplicating them can reproduce years of permission sprawl.
Copy the role. Do not copy the history.
Use the existing employee to identify likely access, then verify each important membership before assigning it to the new account.
Step 2: Create the account in the authoritative system
The correct starting point depends on how the organization manages identity.
Hybrid environment
On-premises AD may be the source
If users synchronize from Active Directory to Microsoft Entra ID, create the user where the organization normally creates synchronized identities, place the account in the correct OU, and allow the established sync process to create the cloud identity.
Cloud-only environment
Microsoft 365 / Entra may be the source
If the tenant is cloud-only, create the account through the organization's normal Microsoft 365 or Entra administration workflow and follow its naming, location, and licensing standards.
Before creation
Check the naming convention
Look at existing users before choosing a username, UPN, display name, email alias, or description. Consistency beats creativity.
Password
Use the organization's onboarding process
Follow the approved temporary-password or onboarding method, require the appropriate password change behavior, and never send credentials through an insecure channel just because it is convenient.
Step 3: Groups first, access second
This is the mental model that makes onboarding easier to understand and easier to support later.
User → Group → Access
Whenever possible, put users into the group that grants the required access instead of assigning permissions directly to the individual user.
Active Directory
Review group membership
Compare role-based security groups carefully. Watch for administrative, legacy, project-specific, or temporary groups that should not carry over.
Check distribution and shared resources
Identify required distribution lists, Microsoft 365 groups, shared mailboxes, calendars, and send-as or send-on-behalf permissions where applicable.
Files
Match file and SharePoint access
Use existing security or Microsoft 365 groups when possible. Avoid creating a direct permission entry for every new employee.
Applications
Do not forget line-of-business systems
Document systems that do not inherit access from AD or Microsoft 365. Accounting, legal, CRM, timekeeping, VPN, phone, and industry-specific applications often require separate provisioning.
Step 4: Microsoft 365 license and mailbox
A user existing in Microsoft 365 does not automatically mean every Microsoft 365 service is ready.
License
Match the required service level
Compare with users in the same role and confirm the employee needs the services included in that license. Do not assign a larger license simply because one is available.
Mailbox
Allow provisioning time
After the appropriate Exchange Online service is assigned, mailbox creation and other cloud-side changes may require time to provision. Avoid repeatedly changing settings because the result is not instant.
Address
Verify the primary email address
Confirm the expected domain, aliases, display name, and address format before handing the account to the user.
MFA
Plan first sign-in
Know how the organization handles MFA registration, Temporary Access Pass or other onboarding methods, Conditional Access, and mobile enrollment before the employee's first login.
Step 5: Verify the setup
Provisioning is not complete until the account can do what the role requires.
Sign-in
Can the user authenticate?
Confirm the account is enabled, the expected username works, the password flow behaves correctly, and MFA can be completed.
Is the mailbox available?
Confirm the mailbox exists and required shared mailboxes, groups, aliases, and Outlook access are present or actively provisioning.
Resources
Can they reach what they need?
Test the essential file locations, SharePoint sites, applications, VPN, printers, and other role-specific resources.
Documentation
Record what was assigned
Document the account, license, important groups, special access, device, exceptions, and anything still waiting on another person or system.
Common new-user failures
When onboarding goes wrong, these are some of the first things worth checking.
Problem
User exists on-prem but not in Microsoft 365
Check whether the organization uses directory synchronization, whether the user is in synchronization scope, whether required attributes are valid, and whether the normal sync cycle has completed.
Problem
Email is not ready
Confirm the correct license and Exchange service are assigned, the account is synchronized if required, and enough provisioning time has passed before assuming something is broken.
Problem
Access denied
Compare the required group membership to the known-good role, confirm the access is actually group-based, and remember that some tokens or cloud permissions may require sign-out, sign-in, or propagation.
Problem
Everything looks right, but the user still cannot work
Separate identity from device configuration. The account may be correct while Outlook, OneDrive, a mapped drive, VPN, printer, or local profile still needs configuration.
What not to do casually
New-user onboarding should be routine. If the setup requires broad or risky changes, stop treating it like a normal onboarding task.
Avoid
Giving direct permissions everywhere
Direct user permissions are harder to audit, harder to remove during offboarding, and easier to forget. Prefer the organization's existing access groups.
Avoid
Copying privileged memberships
Do not duplicate Domain Admin, local administrator, elevated Entra roles, security administration, finance access, or other privileged memberships simply because the comparison user has them.
Avoid
Changing global policies to fix one onboarding issue
A new user failing MFA, mail, sync, or sign-in is not a reason to weaken Conditional Access, authentication, mail flow, or tenant-wide security settings.
Avoid
Deleting and recreating immediately
If provisioning is delayed, investigate first. Repeatedly deleting and rebuilding identities can create duplicate objects, synchronization conflicts, mailbox issues, and more cleanup.
When to escalate
Escalation is part of good administration, not a failure to troubleshoot.
Escalate
Synchronization errors you do not understand
If the identity is duplicated, conflicting, excluded unexpectedly, or showing directory synchronization errors, gather evidence and escalate before changing synchronization configuration.
Escalate
Privileged or sensitive access
Administrative roles, executive mailboxes, finance systems, HR data, security tools, and other sensitive access should have clear authorization before assignment.
Escalate
The fix appears tenant-wide
If solving one user's onboarding appears to require changes to Conditional Access, synchronization, DNS, mail flow, domain settings, or global security policy, stop and involve the appropriate administrator.
Good onboarding is boring, repeatable, and easy to explain.
If you can identify the correct role, create the identity in the right system, assign access through groups, verify the result, and document the exceptions, you have the foundation of a reliable new-user process.