The Production IT Operations Runbook: Employee Onboarding & 30-Day Security Audit

Phase 1: Pre-Day 1 Hardware & Identity Provisioning

Start from an approved HR or manager request containing the employee’s legal name, start date, manager, department, location, role, and approved access profile. Use that request as the source of truth; do not infer elevated access from a job title. Assign the endpoint and identity work to named owners early enough to resolve stock, licensing, or approval issues before the employee arrives.

Prepare a known-good, attributable endpoint

• Asset tagging in the CMDB: Assign a unique asset identifier and record serial number, make/model, assigned user, purchase/warranty details, location, and lifecycle status. Apply the physical tag and reconcile the device record against the actual hardware before release.
• Clean OS deployment: Provision from the organization’s approved, supported image or zero-touch enrollment profile. Apply the current security baseline, remove stale local accounts and unapproved software, confirm time synchronization, and record the build or enrollment result.
• BitLocker/FileVault key escrow: Enable full-disk encryption before user data is placed on the device. Verify the recovery key has escrowed to the approved Entra ID, AD, or MDM repository and that authorized recovery staff can retrieve it; never place recovery secrets in the asset notes or ticket.
• EDR/RMM agent verification: Confirm the endpoint appears in the correct tenant, reports healthy and current, and is assigned the intended policy. A locally installed agent is not proof of protection: check in-console heartbeat, device identity, and alert status.

Provision least-privilege identity and services

• AD/IdP account creation: Create the account from the approved identity request with a unique sign-in name, correct directory attributes, manager, organizational unit, and lifecycle status. Use a controlled provisioning workflow where available and document the immutable user identifier in the ticket.
• RBAC security group assignment: Apply only role-approved baseline groups and application entitlements. Check inherited access, nested group membership, privileged roles, and conflicting duties. Record who approved each non-standard group and its review date.
• SaaS license provisioning: Allocate only the licenses needed for the employee’s approved duties. Confirm seat availability and application access, record the SKU/assignment in the identity ticket, and set a review trigger for temporary or premium licenses.

Phase 2: Day-1 Access & Handover

Verify the recipient’s identity using the organization’s established in-person or remote verification process before disclosing access details or transferring equipment. The manager or sponsor should confirm the role and requested access. Provide concise instructions, then ask the employee to complete the sign-in and recovery steps themselves rather than observing or recording their secrets.

• Enforced MFA authenticator app setup: Require registration of the approved authenticator or phishing-resistant factor, enforce MFA through the identity provider’s policy, and verify a fresh sign-in challenge. Provide a secure recovery method consistent with policy; do not treat SMS as equivalent where stronger factors are required.
• One-time secret credential handover: Deliver the initial sign-in secret through an approved, access-controlled channel separate from the account identifier where possible. Require a change at first sign-in, prohibit reuse, and never put passwords, recovery codes, or private keys in tickets, email, or chat transcripts.
• 802.1X/VPN certificate setup: Enroll the managed device for certificate-based network access using the approved device identity and profile. Test 802.1X and remote VPN access from the expected network path; verify certificate validity, renewal behavior, and revocation ownership.
• Ticketing portal onboarding: Confirm the employee can access the service portal, find support instructions, and submit a test or real request. Explain severity routing, support hours, and how to report a lost device or suspected compromise.
• Digital asset acknowledgment: Obtain the organization’s electronic acknowledgment for the specific issued equipment and accessories. Record asset IDs, condition, handover timestamp, policy version, and the employee’s acknowledgment in the approved asset or HR system.

Phase 3: 30-Day Post-Onboarding Security Audit

Schedule the review when access is requested so it is not forgotten after the immediate start-date work. Compare effective access with the employee’s actual duties and manager approval. The review should be performed by someone with authority to remove access and, where practicable, not solely by the person who provisioned it.

• Audit temporary privilege escalations: Review PIM/PAM activation history, local administrator membership, emergency elevation grants, and temporary group changes. Confirm each elevation had a business justification, approver, bounded duration, and completed removal; investigate any standing privilege that was meant to expire.
• MDM/WSUS patch health check: Confirm the device remains enrolled and compliant, has checked in recently, and has installed required OS and application security updates within policy. Investigate failed or deferred updates, stale WSUS/MDM status, disabled controls, and unsupported software; document remediation and due date.
• Shadow IT inspection: Review endpoint software inventory, browser extensions, unsanctioned cloud storage, OAuth grants, and relevant proxy/CASB or SaaS discovery alerts. Validate business need with the manager; remove prohibited applications or move approved use into sanctioned, managed services.
• Cloud backup sync verification: Verify protected folders and approved cloud backup clients are active, current, and associated with the correct employee identity. Check recent successful sync/backup status and restore capability without exposing personal data; resolve quota, policy, or authentication errors.

Phase 4: Emergency Offboarding Protocol

Offboarding is a coordinated identity, endpoint, data-retention, and asset process. Follow legal hold, privacy, labor, and incident-response requirements for the jurisdiction and case. For an involuntary or security-sensitive departure, coordinate timing with HR and the incident commander; avoid notifying the departing user before access controls are ready.

• T-0 account revocation & session kill: At the authorized effective time, disable the primary identity and linked accounts, revoke refresh tokens and active sessions, invalidate application sessions where supported, remove privileged access, and block remote access. Preserve audit logs and evidence before routine cleanup. Verify revocation in the identity provider and critical connected services; prioritize this step for emergency containment.
• T+24h mailbox/drive reassignment: After the documented approval and retention/legal-hold check, delegate or transfer business records to the manager or designated custodian. Apply mailbox auto-reply or forwarding only where policy and law permit. Keep access time-bound, log the recipient and scope, and verify shared files remain owned by the organization rather than an individual account.
• T+7d hardware sanitize & license reclamation: Recover all issued devices and accessories, update custody in the CMDB, then sanitize or securely erase storage using the approved media procedure before redeployment or disposal. Reclaim SaaS and platform licenses only after retention and transfer needs are met; record the sanitization certificate, asset disposition, and reclaimed seat.