Contents
What needs to be ready before day one?
Onboarding starts two weeks ahead. That's the time it takes to order a computer, receive it and set it up without rushing. By the day before, everything should be ready: the new hire turns on their computer, signs in once, and finds all their tools.
| When | What to do |
|---|---|
| 2 weeks before | Order the computer and its accessories (monitor, headset, charger), or take one from stock |
| 1 week before | Create the Microsoft 365 or Google Workspace account and the email address, and add it to the right access group |
| The day before | Install the software for the role, check access to the tools (messaging, CRM, payroll software, shared folders), prepare two-factor authentication |
| Day one | Hand over the computer, turn on two-factor authentication with the person, show them who to ask for help |
| The first week | Check that no access is missing, and record in the inventory who has which equipment |
When nothing is ready, the cost shows up mostly on the new hire's side. A day without a computer or without access is a day's salary paid to wait, and a poor first impression. On your team's side, the person in charge (often the office manager or HR) spends hours ordering, chasing and creating accounts one by one in each tool.
What needs to be shut off when someone leaves?
Offboarding happens on the last day, at the time the person leaves. Earlier, they can't finish their work. Later, they keep access to your emails, your files and your customers. The CNIL, France's data protection authority, requires removing a person's access as soon as their contract ends (CNIL, managing authorizations, in French).
| What | What to do |
|---|---|
| Main account (Microsoft 365, Google Workspace) | Block it, then forward new emails to a colleague |
| Emails and files | Hand them over to the manager or the replacement before deleting the account |
| Other tools (CRM, payroll, accounting, team chat) | Close each account, one by one |
| Licenses | Reassign them to the next hire, or cancel them |
| Computer and phone | Collect them, then lock and wipe them remotely if they don't come back |
| Shared passwords (Wi-Fi, shared accounts, password vault) | Change the ones the person knew |
| Physical access | Collect the badge and keys |
A poorly handled departure carries two risks. Security first: a former employee who still has access to the CRM or the Drive can walk away with your customer files, even with no bad intent, and a computer that never comes back still holds your data. Cost next: every forgotten license keeps being billed every month, for someone who is no longer there, and equipment that doesn't come back has to be bought again.
How much time does it take?
It all depends on how your IT is set up. For a small business that hires and loses the equivalent of 15% of its headcount each year, we estimate the time spent as follows:
| Per year | 50 users | 100 users | 150 users |
|---|---|---|---|
| New hires per year (15% of headcount) | 8 | 15 | 23 |
| Departures per year (the same) | 8 | 15 | 23 |
| Without setup: 3 h per hire, 1 h per departure, one lost day per new hire | 90 h | 165 h | 250 h |
| With the right setup: 20 minutes per hire, 10 per departure | 4 h | 8 h | 12 h |
Without setup, every onboarding is redone by hand: an account to create in each tool, a computer to set up one program at a time, missing access discovered over the course of the week. For a 100-person company, that adds up to nearly five weeks of work a year, lost between the team doing the prep and the new hires waiting.
What setup should you put in place?
The right setup rests on a simple idea: you don't give access to a person, you put them in a group, and the group carries the access.
Access groups by role. A "Sales" group grants the CRM, the sales team's folders and its chat channels. A "Finance" group grants the accounting software and the financial folders. When someone joins, you add them to their group, and all their access opens at once. When they leave, you remove them, and everything closes. These groups are created in your directory, Microsoft Entra ID or Google Workspace, and connect to your other tools through single sign-on ("SSO": one login for every tool).
Computers configured remotely. A device management tool (an "MDM", for mobile device management) installs the software and settings of each group on every computer: the salesperson gets the CRM, the accountant gets the accounting software, and everyone gets disk encryption and updates. The computer can be shipped new, still in its box: it sets itself up on first sign-in. On the last day, the same tool locks it and wipes it remotely.
A regular access review. Even with a good setup, access drifts: a permission granted for a project and never removed, an account created outside the groups, a license assigned to nobody. A monthly review spots inactive accounts, unused licenses and permissions that no longer match the role. The CNIL recommends a review at least once a year (CNIL, managing authorizations, in French).
Who handles it when you don't have an IT person?
In a small business without an IT person, onboarding and offboarding often fall to the office manager or HR, who creates accounts in the tools they know and misses the ones they don't see. The IT provider, when there is one, doesn't always handle it: out of more than 900 IT providers in the Paris region analyzed by Vauban, fewer than half (43.5%) offer this service. With the others, it stays on your plate (details in our article on pricing).
Onboarding and offboarding with Vauban
At Vauban, onboarding and offboarding are part of the Onboarding and offboarding plan, at €25 per user, per month, Helpdesk included. The computer is ready to use on day one, then locked and wiped remotely on the last day. Accounts are opened on day one, closed on the last, and licenses recovered. You always have an up-to-date list of who has access to what in your tools. We set up the access groups, the computer configuration and the access review, connected to your HR software: a new hire entered on the HR side triggers the preparation of the computer and the accounts.
To see the difference, the first month is free: we handle your next new hires without billing you anything. Request it here.
