Microsoft 365 / New employee setup: accounts, licenses and access

For a new Microsoft 365 employee, create the account, confirm the usage location and required licenses, grant approved group memberships and roles, and verify the employee’s first sign-in and access. Creating an account alone does not make email and collaboration services ready. Start with an approved list of access requirements, then check that the employee can actually use the required services.

Information to obtain before starting

Confirm the new employee’s display name, login name and email address to be used, start date, department, work country/region, required apps, team/site access scope, and admin role with HR and business owners. Also check that there are no accounts with the same name or existing aliases. Even when creating multiple accounts at once, do not uniformly copy permissions and licenses; verify them according to job duties.

Licenses can only be assigned if the organization has a subscription and available license seats. The usage location applied to the user is designated based on actual work information, as it is related to service availability. You can check the current menu and permission conditions in Microsoft's guide to adding users and guide to assigning licenses.

Dividing request, approval, execution, and verification responsibilities

A request to copy a neighboring employee’s setup does not replace an approved permissions list: that employee may have temporary project access or administrative privileges. For a rehire, inspect existing and deleted accounts and data-transfer requirements before creating another account. In an organization that synchronizes an on-premises directory, first establish which directory is authoritative and create the account through that approved process.

Order of new employee account and license setup

1. In the Microsoft 365 admin center’s dashboard view, open Users → Active users, search for the intended sign-in name and existing addresses, and check available license seats. Use an account authorized to create users, such as a User Administrator within its permitted scope. A License Administrator can manage license assignments but cannot create users solely by holding that role; see Microsoft’s License Administrator permissions.
2. Select Add a user. Enter the name, username and domain, check the organization’s naming rules, and set the usage location when assigning product licenses. Review the password settings, including requiring a password change at first sign-in for this password-based account. If the tenant uses a synchronized source directory, follow its approved creation and synchronization process instead of creating a duplicate cloud account.
3. Select the required product licenses and service plans. Choose based on the features actually needed for work, such as mail, Teams, and desktop apps, and do not assign unnecessary products out of habit.
4. Review the settings and select Finish adding. Reopen the user under Users → Active users → Licenses and Apps and verify the saved products and service plans. License assignment and service provisioning are separate states; a mailbox can still be preparing after a license is assigned.

Decide on the initial password delivery method and the user verification method before creating the account. Have the user change the password and register authentication during their first login and do not ask them to provide the new password or authentication code to the administrator. Detailed input routes and error branches can be checked in account creation and license assignment guide.

How are groups and access permissions granted?

Security groups can control app or resource access and policy scope; Microsoft 365 groups can connect collaboration resources such as Teams and SharePoint. Obtain approval from the business and resource owners before adding the employee. If licenses are group-based, identify which assignments are direct and which are inherited, and check for incompatible products or service plans rather than adding extra direct assignments to hide an error. Microsoft’s guide to group-based licensing explains the assignment and troubleshooting workflow.

The administrator role is treated separately from general user permissions. Only grant the minimum permissions necessary for the assigned tasks, and if possible, separate general work accounts from administrative accounts.

For Teams membership, open Teams admin center → Teams → Manage teams → the target team → Members and add the approved account; Microsoft documents these controls in its guide to assigning team owners and members. For security or Microsoft 365 groups, use Teams & groups → Active teams & groups in the Microsoft 365 admin center. Do not give a SharePoint reader full team membership just to make a file accessible, because membership can grant editing and other collaboration access. Verify shared-mailbox read and sending delegation separately from group membership.

Verification sequence for organizations using group-based licenses

1. First, check the products and apps associated with the license group for the relevant job role. For dynamic groups, also ensure that the attributes of new employees, such as department, match the rules.
2. Add the user to the approved group and read the member list again. Do not assume that a nested structure where a user is added only to another group within the group will propagate license assignments.
3. Check the actual assignment results in Billing → Licenses under the product and user details. Successful addition to a group and successful product assignment are separate statuses.
4. If assignment fails, open Billing → Licenses → the product → Errors & issues. Inspect the affected user for insufficient seats, invalid usage location or conflicting service plans. Correct the cause, then select Reprocess in the user’s error details and check the resulting assignment again. Do not directly assign another product merely to conceal the original error.

Since the same user can have multiple assignment paths, record whether it is a direct assignment or which group it was received from. When changing roles and moving to another license group, reduce service gaps by checking the addition of the new group and the application of the new product before removing from the existing group. However, license transfer and revocation of access to materials must each be verified separately.

What to check before the first login

• Ensure that the initial password and delivery method comply with the organization's security procedures, and guide the user to change the password at first login.
• Explain multifactor authentication (MFA), which verifies identity using more than one type of factor, and tell the employee which registration methods the organization permits. Explain any device enrollment and Conditional Access requirements as well. Allow time to prepare an approved authentication method; administrators should not collect the employee’s verification codes.
• Check the email reception address, required team/site access, and app availability with the new employee or the person in charge.
• If there is a problem, narrow down the cause in the order of license assignment results, group membership, login logs, and service status.

First day work test and handover records

For example, use the following checks when onboarding a sales representative. Use documents without actual customer information and approved email recipients.

1. The new employee logs in with the correct company account and completes MFA registration and authentication. If company PC registration is required, check the device preparation and conditional access results as well.
2. Open the mailbox in Outlook for the web and check internal and external test sending and receiving. If using a shared mailbox, also check the delegation access of your account and the permitted sender identity.
3. Open test documents in the designated team/site and perform reading and editing according to your job duties. Simply being able to open folder links does not mean all data permissions are appropriate.
4. Install and activate the necessary desktop apps and save documents. Distinguish where failures occur among app permissions, file access, and device policies.
5. Give the employee and department contact a record of completed and outstanding checks, together with the support contact. Record who will remove temporary access and clean up test materials, and when that work is due.

If the login step fails, check login log; if only the app does not open, check the license and service preparation; if only a specific file does not open, check the actual storage permissions. Do not repeatedly create new accounts just because a new employee cannot log in on their first day. For incorrectly assigned groups or roles, revoke only that item and also verify whether other work access remains.