Employee onboarding often creates a short period in which IT must deliver initial credentials before the employee has access to normal corporate systems. This is precisely when teams are tempted to email passwords or place them in onboarding tickets. A defined process prevents those temporary shortcuts from becoming permanent risk.
Create an individual identity before sharing access
Use the employee's named account rather than a shared onboarding account. Assign only the roles and applications required for the job.
Use a temporary password
If the platform requires an initial password, generate a temporary value that must be changed at first sign-in. Avoid reusing a standard password for multiple employees.
Verify the employee before delivery
Use established HR or manager information to confirm the recipient. Do not rely only on an unexpected personal email message claiming to be the new employee.
Keep the password out of the onboarding ticket
The ticket can document that the account was created, access was approved, and the temporary credential was delivered. Deliver the actual value through an approved temporary channel.
Enroll MFA during the first session
Where possible, complete MFA registration as part of the initial setup rather than leaving the account protected only by a temporary password. Explain recovery options and ensure the employee understands which requests for verification codes should be treated as suspicious.
Confirm device security
Managed-device enrollment, encryption, endpoint protection, patching, and screen-lock requirements should be completed before privileged access is granted.
Close the onboarding loop
Confirm that the employee successfully changed the temporary password, registered required authentication methods, and can access necessary applications. Close the ticket without storing the final password or recovery codes.