“Give them the same access as Sam” is a tempting instruction when a colleague starts on Monday. But Sam might cover payroll, help with an old project and still belong to a group created during a migration. Copying the account copies those decisions too.
A better joining routine begins with the new person's work. What do they need to do in their first week, which systems support it and who can approve access? You can answer those questions in a short support request. You don't need a complicated new form.
Agree the work before creating the account
The NCSC's Cyber Essentials requirements call for a process to create and approve accounts, unique user credentials and access appropriate to the person's role. Those are the scheme controls. The joining routine below is a suggested way to put them into practice, not an extra prescribed checklist.
Ask the manager to name the tasks and systems the starter needs. “Customer work” is vague. “Prepare quotes in the sales application and open the current project folder” gives the person setting up access something they can act on.
Include the start date, manager, relevant team and any known end date for temporary work. Name the person authorised to approve each request. If a system owner is away, use an agreed substitute rather than treating silence as approval.
Choose a starting role, then check what it includes
Existing job roles or groups can make account setup easier. Ask IT to explain what a proposed role allows before applying it. A label such as “office staff” isn't enough to tell you whether somebody can also open salary files.
Imagine a fictional repair company hiring a customer-service assistant. They need to see appointments, contact customers and record job notes. They don't automatically need to change bank details, export the entire customer list or manage other people's accounts.
Discuss those differences with the relevant system owner. A sensible request names the actions the person needs as well as the application. If the product's built-in role grants more access than expected, record that limitation and decide how the work should be handled before enabling it.
Give the person their own identity
IASME's user access guidance explains why sharing account credentials makes activity harder to attribute. Shared work doesn't require everyone to use the same login. Ask your provider to use the service's supported arrangement for individual access to team resources.
For example, two receptionists might both need to handle an enquiries inbox. Describe that need to IT instead of asking for a shared password. Have each person try the approved way of reaching the inbox through their own account.
Avoid renaming the previous employee's login for the new starter. Ask IT to create the right identity and handle any required access to previous business records separately. The manager should decide what work needs handing over. Nobody should inherit an unexplained set of permissions just because the account already exists.
Make first access a supported appointment
Set aside a short slot with the starter and whoever provides IT support. Tell the person in advance how they'll receive genuine setup instructions and whom to contact if anything looks wrong. Verify unexpected requests through the contact details you've already agreed.
Use the provider's approved method for initial credentials or invitations. Don't put passwords in the manager's general joining spreadsheet. Let the starter complete their own authentication setup, with help that doesn't require them to reveal secret codes.
Check cloud MFA during this appointment. Have IT confirm the account is covered by the intended protection, rather than stopping when an authenticator app has been installed. Our cloud sign-in checks explain the difference between registration and enforced protection.
Give the starter a clear recovery route if they lose their phone or can't sign in. That could be a support number and instructions for how support verifies them. Try to resolve confusion now, while help is available.
Test one ordinary piece of work
Ask the starter to complete a harmless practice task using fictional information. In the repair-company example, they could open an approved training appointment and add a test note. Confirm that the tools needed for their role work together.
Also ask the administrator to check the permission boundaries against the approved request. Don't ask the starter to open private employee files as a test. The check should confirm the configured permissions without exposing information they shouldn't see.
If something doesn't work, record the specific task and error. Giving broad administrator access to make the problem disappear can leave the real cause unresolved. Our separate administrator account guide covers the arrangement for people who genuinely perform administrative work.
Close the request after checking the result
Keep the approval, accounts created, roles granted and outstanding actions in the same support record. Record completion without storing credentials. Tell the manager what still needs a decision, including any request you deliberately haven't granted.
Arrange a brief follow-up after the person has tried normal work. A first-week check is a useful local habit, not a Cyber Essentials deadline. Ask what is missing and whether any temporary access can now be removed.
IASME's guidance for small organisations makes clear that account creation and tracking matter even as a business starts to grow. Keep the routine small enough to use for the next employee, volunteer or contractor. It should help people get working with the access they've actually been approved to have.