Employee Onboarding Checklist for Email Access: Day One Done Right

A new hire's first day sets their habits. If they receive a mailbox with a password on a sticky note, no second factor, and no idea where to report a suspicious email, that is how they will treat email for as long as they work with you. This checklist takes about 30 minutes per person, most of it before they arrive, and it is the mirror image of the offboarding list you will need later.

Quick answer

Before day one: create the mailbox in the company naming format, add it to the right groups and aliases, and prepare a temporary credential in the password manager. On day one: they sign in, set their own password, enrol two-factor authentication, connect their mail app, set a signature, and get a ten-minute security briefing. Record every step so offboarding can reverse it.

Before they arrive

1. Confirm the exact spelling of their name and the address format your company uses (firstname@, first.last@, or initial-surname@). Consistency matters more than the format itself.
2. Create the mailbox. On OquMail, add the mailbox from the dashboard; the free plan covers up to 15 mailboxes with 5 GB each, so a new hire costs nothing extra.
3. Add the address to the groups and role aliases they need: support@, sales@, or a team list. Write down which ones.
4. Generate a temporary password in the company password manager and share it through the manager, not by email or chat.
5. Prepare their entry in the shared signature template: name, role, phone, website. Keep it plain text friendly.
6. Decide which devices they will use and whether a company device is issued. A personal phone with work mail on it needs a screen lock and the ability to be wiped of work data.

On day one, with them

1. They sign in to webmail with the temporary password and immediately change it to a generated one of 16 or more characters stored in their password-manager vault.
2. They enrol two-factor authentication with an authenticator app or a hardware key and save the backup codes to the manager.
3. They connect their mail app. For OquMail that is IMAP mail.oqumail.com port 993 SSL/TLS and SMTP mail.oqumail.com port 587 STARTTLS, username is the full address. On 587 the app must be set to STARTTLS, not SSL.
4. They paste the signature and send a test to a colleague who replies, confirming both directions work.
5. They add the security reporting address (for example security@yourdomain.com) and the office phone numbers to their contacts.
6. Ten-minute briefing: the six phishing tells, the rule about never entering a password from an email link, the phone-verification rule for any bank-detail change, and where to report anything odd.

Access decisions to make deliberately

• Should they see the shared inbox history? If support@ delivers into their mailbox from today, they will not see old threads; if you give them the role mailbox login they see everything. Choose based on the job.
• Do they need to send from a role address? Configure the identity in their mail app rather than sharing the role mailbox password.
• Do they get the domain registrar, DNS, or mail-admin login? Almost always no. Keep admin access to two named people.
• Do they need an API key for a system they will maintain? Issue a key named after them and the system, and record it for revocation later.

Record it

Keep a simple onboarding record per person: mailbox address, groups and aliases, devices, app passwords or API keys issued, and the date. The offboarding checklist is exactly this list read backwards, and without it you will miss the forwarding rule or the API key that keeps working after they leave.

Mistakes to avoid

• Sending the temporary password to their personal email. Personal accounts are outside your control and often reused.
• Letting them keep the temporary password because it "works fine".
• Giving contractors the same access as staff by default. Scope it to the project and put an end date in the record.
• Skipping the briefing because they are technical. Developers click phishing links too.

Common questions

Should a new hire get a personal address or just the role address?

Both. A personal address gives accountability and a clean offboarding; a role address gives customers continuity. Have the role address deliver to the individual, and remove that routing when they leave.

What about part-time staff or volunteers?

Same checklist, with a scheduled review date. Accounts that were "temporary" and never removed are a common way old access lingers.

How long should this take?

About twenty minutes of preparation and thirty minutes together on day one. It is the cheapest security investment you will make for that person.