How to Set Up User Accounts: A Practical Guide
An IT user account setup checklist makes sure every new starter, and every role-changer, gets exactly the access they need on day one, and nothing they don’t. Without it, setups are inconsistent: one person waits a week for email, another gets admin rights they never needed, and security is whatever the person doing the setup remembered that morning. This guide explains how to use the IT User Account Setup Checklist properly.
When to Use This
Use the checklist for every new starter, before their first day if possible, aim to have accounts ready so the person can work from hour one. Also use it for role changes (new department, promotion, transfer), returning staff, and contractors. The same discipline applies in reverse: pair it with a leaver checklist so accounts are disabled promptly when someone leaves.
Timing matters. The checklist should be triggered by HR or the hiring manager as soon as the start date is confirmed, not on the morning the person arrives. Late notification is the root cause of most rushed, incomplete setups, build the lead time into your onboarding process.
For contractors and temporary staff, complete the same checklist but mark the account with an expiry date from the start. Temporary accounts created “quickly” without the checklist are the ones still active a year later.
How to Fill It Out
Section 1: User details. Full name, job title, department, start date, manager’s name, and employment type (permanent, fixed-term, contractor). If the organisation uses a naming convention for usernames and email addresses, record the generated addresses here so they’re consistent and checkable.
Section 2: Core accounts. The standard set every employee gets: email, network login, VPN access if applicable, and the company directory entry. Each item is a tick-box with a field for the account name created and the date. The point of listing them explicitly is that nothing gets forgotten, the forgotten item is always the one that blocks the new starter on day one.
Section 3: Role-based access. Systems and permissions specific to the role, cross-referenced to the access request form where the business justification and approvals live. Don’t duplicate the approval process here; the checklist confirms the approved access was actually provisioned. List each system, the access level granted, and the date it was set up.
Section 4: Hardware and devices. Laptop or desktop assigned (record the asset tag), mobile phone if applicable, security tokens or keys, and any peripherals. The device handover should be signed for, a simple acknowledgement that the person received the equipment, which protects both sides if something goes missing.
Section 5: Security setup. Multi-factor authentication enrolled, initial password set with forced change on first login, security awareness briefing completed (even a short one, phishing awareness, password policy, who to contact). This section is the one most often skipped under time pressure, and it’s the one that prevents the most incidents.
Section 6: Completion and verification. The IT staff member who performed the setup signs and dates the checklist; the new starter’s manager confirms the person can log in and access what they need. Any item that couldn’t be completed, a licence not yet purchased, a system pending vendor setup, goes here with an owner and a follow-up date, not into someone’s memory.
Common Mistakes
1. Starting on day one. IT learns about the new starter when they walk in the door. Everything is rushed, security steps get skipped, and the person sits idle for days. Fix the trigger: HR notifies IT the moment the contract is signed, with a minimum lead time in the onboarding policy.
2. Cloning the predecessor’s access. Copying the previous role-holder’s accounts is fast and almost always wrong, it carries over accumulated access the new person doesn’t need and misses new requirements. Build access from the role description and the access request form, not from the last person in the chair.
3. Skipping the security briefing. The account is ready, the laptop is handed over, and nobody mentions phishing, passwords, or the incident reporting process. Five minutes on day one prevents the clicked link that costs far more later. Make it a checklist item so it can’t be skipped quietly.
4. No verification step. The checklist is filled in by the person who did the setup, and nobody checks the new starter can actually log in. A quick confirmation with the manager on day one catches the mistyped username, the missed licence, and the system nobody provisioned.
Who Needs to Sign Off
HR or the hiring manager initiates the checklist and confirms the user details. IT completes the technical sections and signs off. The new starter’s manager verifies the person can work, logins function, required systems are accessible. In organisations with an IT manager, they review completed checklists periodically for consistency.
How Often to Review and Update
The checklist is used per person, per event, it’s not a periodic document. But review the template quarterly: the standard account set changes as systems are added or retired, naming conventions evolve, and the security section should reflect current policy (for example, if MFA becomes mandatory for a new system). Audit a sample of completed checklists twice a year to check they’re being filled in fully rather than ticked blindly.
Download the free IT User Account Setup Checklist template.
Disclaimer: account provisioning may involve processing personal data and is subject to data protection regulations that vary by jurisdiction. This guide is general information, not legal advice. Check your local regulations when handling employee data.