A new employee's first day is a stress test for IT in an SME. If at 9:00 there's no mailbox login, no shared drive access and no laptop with the right tools installed, the next few weeks will be one delay after another. Most of this chaos is avoidable — if someone on the IT side starts thinking about onboarding three days before the start date, not on Monday at 8:00.
In most 10–50 person companies, onboarding looks like this. HR has agreed a start date with the new hire. At 9:00 on Monday they show up at the office, get a coffee and wait. The line manager runs around asking "who can set up their email", "is the laptop from storage configured", "does anyone remember the CRM admin password". Day one is two coffees, one lunch and half an hour of actual work.
This is not a technical problem. It's a communication problem — which, not by accident, can be solved with one sheet of A4 and one email three days earlier.
A real example: a 28-person B2B distributor
At one of our clients — a 28-person industrial parts distributor running Comarch Optima and a custom CRM — getting a new sales rep operational used to take three working days. The cause was banal: each of the 8 systems (ERP, CRM, email, shared drive, warehouse, VPN, VoIP phone, calendar) required a ticket to a different person, and none of those eight people knew the other seven tickets also had to be raised. The new hire spent three days clicking through "access denied" and asking colleagues to email things over.
After we rolled out a single sheet of A4, a short Active Directory automation (groups instead of individual permissions), and one HR-to-IT form sent on the day the contract was signed, a new sales rep's first day now closes in 90 minutes — from walking into the office to filing the first ticket in the CRM. Across a year with 6–8 new hires, that's roughly 130 hours of work saved that nobody had been counting before, because "that's just how it is".
This is not complex technology. It's discipline and one list you actually stick to.
Three days before start
Onboarding doesn't start at 9:00 on Monday. It starts at the latest on the previous Thursday. The lack of communication between HR and IT is the classic reason a new hire spends half their first day staring at an empty desk.
What must reach IT no later than three days before the start date:
- First name, last name, job title, start date, line manager.
- Role from the company's access matrix (e.g. "east region sales rep", "accountant", "warehouse operator"). The role drives the list of systems and the permission level.
- Workplace setup — office, hybrid, fully remote. This determines whether a VPN is needed and what hardware.
- Personal phone number (for MFA and first login).
- Whether a company phone, access card or printer is needed.
If your company doesn't have a "role → systems → access level" matrix, that means you're improvising at every onboarding. That works until the first incident of the type "the new sales rep saw purchase prices for two months because we copied their permissions from a colleague who happened to have procurement rights".
Day one — accounts and access
The goal: by 11:00 the new hire is logged into their own account, has hardware, and knows where to find basic tools. The rest of the day is spent on actual work, not on waiting for a password.
The minimum set that must work on first login:
- Main directory account (Active Directory / Microsoft 365 / Google Workspace) with MFA configured.
- Company email with a signature and an alias following the company standard.
- Shared drive access — only the folders for the role, not "the whole company drive because it's easier".
- ERP/CRM account with permissions tied to the position. No "copying from sales rep X because that's quick".
- Computer with business apps installed, antivirus agent and signed policies (disk encryption, screen lock after five minutes).
- Temporary password that forces a change on first login.
- VPN access (if applicable) — tested, not "let's figure it out Wednesday morning".
A common mistake we see in SMEs: giving a new employee local admin rights on the laptop "because it's easier to install Skype". That's a one-off convenience that, from a ransomware perspective, costs 5–10 days of company downtime. Local admin is not a standard. It's an exception that requires justification.
First week — training and habits
Day one is about access. The first week is about habits. This is where you decide whether the new employee takes security rules seriously, or starts working around them by Wednesday.
What's worth doing in the first week:
- A short security conversation: phishing, passwords, clicking links, reporting incidents. Thirty minutes with a real person, not a 3-hour e-learning that nobody watches.
- Onboarding to the company password manager — showing how to add the first entry and how to share passwords inside the team. Without this, by Friday the employee will have signed up for three SaaS tools with
Spring2026!as the password. - The incident reporting procedure — one email address or one Slack channel where everything goes: lost phone, suspicious email, printer not working. Without this, the employee calls three people and nobody knows anything.
- A first access check after three days — is the new hire actually using only what was assigned? M365 / Google Workspace logs show this in a minute.
It sounds formal. In practice it's 90 minutes spread across four short conversations during the week.
The pitfalls we see most often
Three things that can wreck even a well-designed onboarding:
- Copying permissions from "a colleague in the team". A classic. A year later, half the department has access to a system that nobody should have anymore. Permissions are copied from the role, not from a person — because the "colleague" has accumulated rights from three previous positions.
- A "temporary" password that lasts a year. If the policy doesn't force a change on first login, the password
Start2026will be live right up to the next incident. - No audit trail of "what changed" in the directory. Without a log of changes in AD / M365 you don't know who gave whom which permissions and when. That comes back as a boomerang during a GDPR audit or after an attack, when the question "who had access to the board's mailbox in February" has to have an answer.
Where to start if you're at zero
If onboarding in your company is chaos today, you don't need an expensive HRIS or IT service management platform. You need three things:
- One sheet of A4 with an onboarding checklist — what IT has to prepare and by when.
- A "role → systems → access level" matrix — in Excel to start with. Five columns, twenty rows. Enough.
- One email address or Slack channel where HR notifies IT about new hires on the day the contract is signed.
Larger companies automate this in Microsoft Intune or PowerShell scripts that provision accounts in bulk. In a 15-person company that's overkill. A sheet of A4 and discipline handle 90% of the problem.
If you don't know where to start — start by counting how many new people you'll hire in the next quarter and how many hours of IT each one currently consumes. Just those two numbers reveal the scale of a cost nobody has ever measured.
Onboarding isn't a technical problem. It's a communication problem between HR and IT — which, not by accident, can be solved with one sheet of A4 and one email three days earlier.