# New employee onboarding: an email security checklist

URL: https://iblockspam.com/blog/new-employee-onboarding-email-security
Last updated: 2026-10-12
Published: 2026-10-12
Topic: Running email day to day
Author: iBlockSpam Team

> Onboard new hires safely: least-access accounts, a secure first sign-in and MFA, week-one scam warnings, a sample welcome email and a 90-day access review.

## Short answer

Secure onboarding means creating the account with only the access the role needs, delivering the first sign-in through a separate channel, and getting MFA registered on day one. In the first week, tell the new hire how you really communicate, that you'll never ask for gift cards, how to verify payment requests and how to report suspicious messages.

A new employee's first weeks are when they know least about how your business works, and scammers know it. This checklist covers the email side of onboarding: setting up the account safely, getting the first sign-in and MFA right, and briefing the new hire on the scams aimed at newcomers. It's the counterpart to our [employee offboarding checklist](https://iblockspam.com/blog/employee-offboarding-email-security).

## Why is a new employee's first week an email security risk?

A new employee is at higher risk because they don't yet know what normal looks like: who their manager is on email, which suppliers are real, or how payments are approved. Scammers exploit that gap, and the technical safeguards around a brand-new account are often weaker too.

The FTC's business blog warns that "scammers are following hiring updates on social media and quickly contacting new employees", often with "an urgent message from the boss, asking for a big favor: purchase gift cards and hand over the numbers" ([FTC, July 2025](https://www.ftc.gov/business-guidance/blog/2025/07/bringing-new-employees-onboard-help-them-avoid-impersonator-scams)). A LinkedIn post announcing a new hire gives the scammer a name, a role and a likely email address.

The account itself has gaps too:

- **The first sign-in.** A temporary password sent by email or text can be intercepted or reused.
- **MFA not yet registered.** In Google Workspace, an enforced 2-Step Verification policy can give new users an enrollment period of 1 day to 6 months, and "during this period, users can sign in with just their passwords" ([Google Workspace Admin Help](https://knowledge.workspace.google.com/admin/security/deploy-2-step-verification)).
- **No warning history.** Microsoft's first contact safety tip, which warns "You don't often get email from" a sender, isn't added to messages sent to a mailbox "created less than seven days ago" ([Microsoft Learn](https://learn.microsoft.com/en-us/defender-office-365/anti-phishing-policies-about)). A new hire's mailbox doesn't get that warning in its first week.

## What should IT set up before the first day?

Before day one, create the account with only the access the role needs and make sure it's covered by every security policy. Record everything you grant, because that list becomes the offboarding checklist later.

| Item | What to do | Why |
|---|---|---|
| Account | Create a named account; never reuse a former employee's mailbox | Old mailboxes carry old forwarding rules, delegates and app grants |
| License and policies | Assign the license, then confirm the user is in scope for anti-phishing and anti-spam policies | Custom policies often apply to groups the new user isn't in yet |
| Groups and shared mailboxes | Add only what the role needs | Broad access widens the damage if the account is phished |
| Admin rights | None on the daily account | Admins get a separate admin account |
| Sign-in method | Prepare a single-use first sign-in (see below) | Stops reusable temporary passwords |
| External sender tag | Confirm it's on for the whole organization | Helps the new hire spot outside impersonators |
| Device | Enroll or protect the work profile before mail syncs | See [BYOD mobile email security](https://iblockspam.com/blog/mobile-email-security-byod) |
| Access record | Log every group, mailbox, app and device granted | Feeds the [offboarding checklist](https://iblockspam.com/blog/employee-offboarding-email-security) |

The [NIST Cybersecurity Framework 2.0](https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.29.pdf) includes the outcome "Cybersecurity is included in human resources practices" (GV.RR-04). In a small business, that mostly means onboarding and offboarding follow a written checklist rather than memory.

## How do you give a new hire their first sign-in safely?

Give the first sign-in through a different channel from the username, make it short-lived, and have the new hire register MFA in the same session. Never send credentials to the new hire's personal email address; if that inbox is compromised, so is your new account.

### In Microsoft 365

Microsoft Entra ID offers a **Temporary Access Pass (TAP)**: "a time-limited passcode that can be configured for single use or multiple sign-ins" that lets a user register stronger methods, such as a passkey or the Authenticator app ([Microsoft Learn](https://learn.microsoft.com/en-us/entra/identity/authentication/howto-authentication-temporary-access-pass)). Microsoft says "the most common use for a TAP is for a user to register authentication details during the first sign-in or device setup."

1. Enable the Temporary Access Pass method under **Entra ID** > **Authentication methods** > **Policies** (at the time of writing, October 2026), and include the group your new hires belong to.
2. On the first day, create a TAP for the user under **Entra ID** > **Users** > the user > **Authentication methods** > **Add authentication method**. Note the value; you can't see it again after you close the screen.
3. Give the TAP to the new hire in person or by phone.
4. The new hire signs in at the Security info page and registers their MFA method.

By default a TAP lasts one hour, and the policy allows lifetimes from 10 minutes to 30 days. One-time use is off by default; turn it on if you want every pass to work only once. A TAP doesn't replace the user's password.

### In Google Workspace

Create the user with a temporary password, turn on the option that asks the user to change it at the next sign-in, and hand the password over separately from the username. Avoid the Admin console option that emails sign-in details to the new hire's personal address. If 2-Step Verification is enforced, set the new-user enrollment period to the shortest window that works for you, ideally a day or two, and register 2SV with the new hire during their first session rather than leaving it to them. Our [2-Step Verification enforcement guide](https://iblockspam.com/blog/google-workspace-2-step-verification-enforcement) explains the settings.

## What should a new employee learn in their first week?

In the first week, a new employee needs four rules, not a full course: how the company really communicates, what you'll never ask for, how to verify payment requests and how to report a suspicious message. The FTC suggests employers "tell staff how you'll communicate and share your direct contact information" and, if you'd never ask staff to buy gift cards, "tell them that."

| Rule | What to say | Example scam it stops |
|---|---|---|
| How we communicate | "I'll email from my company address or call from this number. I don't text work requests." | "Hi, it's [CEO]. Are you free? Text me back on this number" |
| What we never ask | "Nobody here will ask you for gift cards, your password or a secret urgent payment." | Gift card requests from a fake boss |
| Verify money and data | "Any change to bank details or an unusual payment is confirmed by phone on a number we already have." | Fake supplier invoice with new bank details |
| Report, don't delete | "Use the Report button, even if you already clicked. You won't be in trouble." | A credential phishing link on day three |

Back these rules with examples. Our guides on [gift card scams](https://iblockspam.com/blog/gift-card-scam-emails), [display name spoofing](https://iblockspam.com/blog/display-name-spoofing) and [payroll diversion scams](https://iblockspam.com/blog/payroll-diversion-scam-emails) show what each lure looks like. New hires in finance or HR need the [payment-change procedure](https://iblockspam.com/blog/business-email-compromise-prevention) before they process anything.

### Example welcome email

Send something like this from the manager or owner, on the first day, from their real company address:

> **Subject:** Welcome, and how to reach me
>
> Welcome to the team. A few quick security points for your first week:
>
> 1. I'll only contact you from this address, in Teams, or by phone from 555-0100. I never text work requests.
> 2. I'll never ask you to buy gift cards, share your password or make an urgent payment in secret. If you get a message like that from "me", it's a scam: call me on 555-0100.
> 3. Any request to change bank details or pay a new supplier is confirmed by phone on a number from our records.
> 4. If anything looks odd, use the Report button in Outlook. Reporting fast is what matters.

This is example text with a placeholder number. Adapt it to the channels your business actually uses.

## What does the full onboarding checklist look like?

The full checklist runs from before the start date to the end of the probation period. Work through it for every hire, including contractors and temporary staff.

1. **Before day one:** create the named account, assign the license, add only role-based groups, confirm the user is in scope for security policies, and record the access you granted.
2. **Before day one:** prepare a single-use first sign-in method and decide how you'll hand it over.
3. **Day one:** hand over the sign-in in person or by phone. Register MFA in the same session, and use a phishing-resistant method such as a passkey where your platform supports it.
4. **Day one:** send the welcome email with your direct contact details and the "we never ask" list.
5. **Day one:** set up mail on the phone using the official app and your mobile policy.
6. **Week one:** 15-minute briefing on the four rules, plus a walk-through of the Report button and the personal quarantine digest, if you use one. See [what email quarantine is](https://iblockspam.com/blog/what-is-email-quarantine).
7. **Week one:** share the [email security policy](https://iblockspam.com/blog/email-security-policy-template) and collect an acknowledgment.
8. **Week one:** for finance, HR and executive assistants, walk through the payment-change procedure.
9. **Day 30:** add the new hire to regular [security awareness training](https://iblockspam.com/blog/email-security-awareness-training-small-business).
10. **Day 90:** review access. Remove groups and shared mailboxes that turned out not to be needed, and confirm MFA is registered and no external forwarding rules exist.

## How does onboarding connect to offboarding?

Onboarding and offboarding are the same list run in opposite directions. Everything you grant on day one (groups, shared mailboxes, delegate rights, app access, devices, SaaS accounts registered to the work address) is something you'll need to remove when the person leaves.

Keep the access record from the checklist above in one place per employee. When someone leaves, the [offboarding checklist](https://iblockspam.com/blog/employee-offboarding-email-security) starts from that record instead of from a guess. The same applies to role changes: when someone moves teams, remove the old access as well as adding the new.

## Next steps

- Turn the checklist above into a template you copy for every new starter.
- If you use Microsoft 365, enable Temporary Access Pass for new hires; if you use Google Workspace, shorten the 2SV new-user enrollment period.
- Write your version of the welcome email now, with your real direct number.
- Check that your domain can't be used to impersonate you to new staff: run the [DMARC Checker](https://iblockspam.com/tools/dmarc-checker) and aim for an enforcing policy.
- iBlockSpam's personal quarantine gives every user, including new starters, a digest of held messages to review; see [quarantine and digests](https://iblockspam.com/features/quarantine-and-digests).

## Frequently asked questions

### Why do scammers target new employees?

New employees don't yet know how their manager communicates, who the real suppliers are, or which requests are normal. Scammers watch hiring announcements on social media and contact new starters quickly, often posing as the boss with an urgent favor such as buying gift cards. A short briefing in the first week removes most of that advantage.

### How should IT give a new hire their first password safely?

Don't send it to a personal email address or in the same message as the username. Hand it over in person or by phone, make it single-use, and require a change at first sign-in. In Microsoft 365 you can issue a time-limited Temporary Access Pass instead, so the new hire registers MFA without a password at all.

### Should new employees have MFA from their first day?

Yes. An account with only a password is easiest to take over, and a new account that's never been signed into is an attractive target. Register MFA during the first sign-in. In Google Workspace, keep the new-user enrollment period short, because users can sign in with only a password during it.

### What email security training should a new hire get in week one?

Keep it to about 15 minutes and four rules: how the company really contacts staff, that nobody will ask them to buy gift cards, that payment or bank-detail changes are verified by phone on a known number, and how to report a suspicious message. Longer awareness training can follow in their first month.

### What should a manager tell a new employee about impersonation scams?

Give them your direct number and say which channels you use. Tell them you'll never ask for gift cards, passwords or urgent secret payments by email or text, and that they should call you on the known number if a message seems to come from you. The FTC recommends exactly this kind of briefing.

## Sources

- [FTC Business Blog: Bringing new employees onboard? Help them avoid impersonator scams (July 2025)](https://www.ftc.gov/business-guidance/blog/2025/07/bringing-new-employees-onboard-help-them-avoid-impersonator-scams)
- [Microsoft Learn: Configure a Temporary Access Pass in Microsoft Entra ID](https://learn.microsoft.com/en-us/entra/identity/authentication/howto-authentication-temporary-access-pass)
- [Google Workspace Admin Help: Deploy 2-Step Verification](https://knowledge.workspace.google.com/admin/security/deploy-2-step-verification)
- [Microsoft Learn: Anti-phishing policies in Microsoft 365 (first contact safety tip)](https://learn.microsoft.com/en-us/defender-office-365/anti-phishing-policies-about)
- [NIST CSWP 29: The NIST Cybersecurity Framework (CSF) 2.0 (February 2024)](https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.29.pdf)
- [CISA, NSA, FBI and MS-ISAC: Phishing Guidance: Stopping the Attack Cycle at Phase One (October 2023)](https://www.cisa.gov/sites/default/files/2023-10/Phishing%20Guidance%20-%20Stopping%20the%20Attack%20Cycle%20at%20Phase%20One_508c.pdf)

## Free tools for this guide

- [Email Header Analyzer](https://iblockspam.com/tools/email-header-analyzer): Trace hops and authentication results — runs entirely in your browser.
- [Email Health Check](https://iblockspam.com/tools/email-health-check): Grade your domain's MX, SPF, DKIM, DMARC and transport security in one scan.
- [DMARC Checker](https://iblockspam.com/tools/dmarc-checker): Check your policy, reporting and the safe path from p=none to reject.

---

Source: iBlockSpam, https://iblockspam.com/blog/new-employee-onboarding-email-security (this is a Markdown copy; the HTML page is canonical). Quote with attribution and a link. Site index for AI assistants: https://iblockspam.com/llms.txt