How MSPs Can Manage Client User Starter Requests

A new starter may arrive on Monday and discover that their laptop is available but their identity, application permissions and working instructions are not. A small managed service provider may have ordered the hardware promptly yet still be blocked by an employer's missing approval, a vendor's licensing decision or a delayed delivery. Reliable new-starter intake is the process of turning an authorised business request into a traceable readiness decision. It should define what the employee needs to perform real work, who approves it and how unresolved dependencies are handled before the person begins.

This article focuses on the intake and handover between a client's manager, the MSP service desk, technical teams and external suppliers. It is not a substitute for HR employment checks or the client's identity policy. The provider should avoid collecting unnecessary employment details, promising unsupported response times or copying an existing employee's entire permission set merely for convenience. Every requested access right, device and service requires an appropriate business justification and an owner who can authorise it.

Receive a complete request from the correct authority

Start with the employee's approved start date, role, location, manager, authorised business entity and intended working arrangements. Confirm the effective time zone and whether the new colleague needs access before their first shift for legitimate induction activities. The request should identify the manager or sponsor who can approve permissions and exceptions. A casual message from a teammate may provide useful context but is not automatically an authorised identity provisioning request. Where the business has an HR-to-IT integration, confirm the record's state and the system responsible for approval.

Use a consistent ticket or service request reference for the whole onboarding case, with linked technical subtasks for identity, hardware, software, telephony and supplier dependencies. Avoid separate unconnected emails that leave no one responsible for end-to-end readiness. The service desk should acknowledge the request according to the actual service agreement, identify missing details and state which tasks can progress. Do not say 'all set' simply because the primary account has been created while vital third-party application permissions remain outstanding.

Ask what work the person must actually perform

A job title may be an imperfect guide to access. Two staff members in the same department can have different duties and client data permissions. Ask the manager for the core business workflows: for example, viewing an approved sales queue, preparing invoices, working with product catalogue records or handling customer enquiries. Map those activities to systems and roles under the client's documented access policy. Identify specialist equipment, accessibility needs or location-specific software through respectful, confidential processes without demanding unrelated medical details.

A well-defined role catalogue helps reduce repeat approval work. Nonetheless, check that the requested role is current and its effective permissions are appropriate. An inherited security group may include privileges granted for an earlier project. Copying the previous holder's account or a manager's permissions can silently expose private data. Use least privilege and obtain explicit authorisation for elevated access. Where a request is genuinely ambiguous, record the blocker and owner rather than granting broad permissions to meet a start-date target.

Identify the equipment and delivery route

Determine whether the starter will receive an existing managed device, newly procured equipment, a loaner or an authorised alternative. Check performance and application requirements, peripherals and any approved accessibility provisions. Assign a stable asset reference and record expected custodian, delivery location and date through controlled systems. A supplier's dispatch notification does not prove receipt by the employee, and receipt does not prove the laptop has been configured or tested. Each is a different milestone.

For remote staff, agree a secure delivery and first-sign-in method. The employee may not yet have access to the corporate portal that normally holds setup instructions, so an approved alternative support contact is essential. Record any device or shipping constraints without putting residential addresses into broad team chats. Confirm management enrolment, disk encryption, endpoint protections and operating-system updates using the client's approved standards. If a hardware order is late, tell the manager what work can proceed and whether a loan device is authorised instead of quietly marking the intake as complete.

Create the identity without weakening authentication

Provision accounts through the supported identity system and approved naming, licence and recovery procedures. Establish multifactor authentication, conditional access and any device compliance conditions that matter to the role. Do not email a permanent shared password or ask the user to send authentication codes to the technician. Where an account is automated from HR or a directory, verify the correct identity and entitlement rather than creating a duplicate login because a downstream application appears delayed.

Microsoft Entra lifecycle workflows provide a vendor-specific way to automate configured joiner, mover and leaver tasks. Automation still depends on licences, workflow settings, connected applications and actual execution. A completion indicator for an identity workflow does not guarantee that a separate payroll or customer system has granted the necessary privileges. Verify critical destination applications and capture their case references. NCSC identity and access management guidance supports controlling identities, least privilege and access lifecycle, but does not define any customer's exact role assignments.

Coordinate third-party licences and permissions

Many business applications are operated by outside vendors or require a named commercial administrator to approve access. Record the specific application, approved access level, supplier route, entitlement owner, expected dependency and next check. A licence purchase order, supplier acknowledgement and successful application sign-in are different states. Do not claim that a paid licence will be ready on the employee's start date without verifying supplier processing and any prerequisites.

Some services use separate privileged accounts, identity federation, hardware tokens or regional restrictions. Ensure the planned access follows the actual contract and client's security obligations. If a specialist tool cannot be made ready immediately, arrange an approved work plan and clear user communication rather than improvising shared credentials. The service desk should understand which supplier owns the next action and remain accountable for agreed customer updates.

Prepare the first-day tasks and support path

Before handover, check that the managed device can complete supported sign-in and that representative applications work under the approved account or authorised test identity. Confirm basic communication, appropriate file access and a task relevant to the role. A desktop icon appearing is not proof that the software licence is active or that the new employee can reach required business data. Avoid using another staff member's credentials as a shortcut to test a restricted workflow.

Provide simple first-day guidance for authentication, password recovery, the helpdesk contact, device security and where to find appropriate instructions. When a new starter is remote or works outside office hours, identify the actual support coverage. A support portal requiring the same failed login cannot be the only help route. Set realistic expectations about outstanding tools or applications and record who will follow up. A short first-day check with the employee is often more meaningful than several completed administrative checkboxes.

Distinguish operational blockers by severity

Not every missing item prevents productive work. If an optional reporting application is awaiting a licence, the manager may choose to proceed with an approved alternative task. If the employee cannot use the identity system, reach core business services or work securely on the available device, readiness may be fundamentally incomplete. Establish which prerequisites are mandatory under the client's role and security rules. A technician should not make a unilateral business decision to waive a critical control just to show green completion.

Maintain a blocker record containing affected capability, reason, business impact, owner, authorised workaround and review point. Clarify whether the failure is caused by missing information, procurement, the MSP, a vendor or a customer's approval. Avoid naming a supplier as the cause without evidence. Where the start date is approaching, escalate through the agreed route early enough for a real decision. A clear conditional readiness status is better than an unsupported claim of full success.

Connect intake to future role changes and offboarding

New-starter records should establish the initial approved access and asset custody that later move and leaver workflows will need. Record temporary entitlements and expiry dates where appropriate. If a contractor has a fixed assignment end date, confirm the correct sponsor and deprovisioning process rather than leaving credentials indefinitely active. Accounts created for a new role should not automatically inherit historic permissions because a previous account template was never reviewed.

Review operational records after the first working period. People may discover legitimate needs that the manager did not anticipate. Route these through ordinary approved changes rather than making informal concessions. Conversely, remove duplicate or unnecessary licences identified during testing. Keep documentation current and access-restricted to the extent necessary to protect personal and security information. The goal is a sustainable identity and device lifecycle, not a one-off request that disappears when a technician closes their task.

Use evidence at handover rather than administrative status alone

Report what is actually ready: confirmed account and MFA, managed equipment, approved role and permissions, working essential applications and a usable support contact. List outstanding dependencies separately with owners and next action. If an application cannot be tested before the employee's first day, record that limitation; do not mark it verified. The manager can then decide what work is reasonable while the remaining tasks proceed. A first-day user acceptance check can confirm that the worker can perform the most important representative actions.

After each onboarding, examine recurring sources of delay. Are requests submitted without role approvals? Are device deliveries repeatedly late? Do vendor accounts require an unexpected sponsorship step? Are new employees unable to complete MFA enrolment without reaching the office? Improve the intake form, role catalogue or supplier arrangements based on actual evidence. Resist adding fields that no one uses; collect only facts that change the next decision. A dependable intake means the employee begins work securely with known ownership of anything not yet ready.

Original sources: UK NCSC, Identity and Access Management, principles for controlling identity and privileges; Microsoft Learn, Microsoft Entra lifecycle workflows, vendor-specific configured joiner and leaver automation. Neither source establishes the contract or exact permissions required for any particular MSP customer.