New starter checklist

A new starter needs several independent things to be true. When one is missing, the

symptom rarely names the missing piece — so work the list rather than the symptom.

#	Must be true	Symptom when missing
1	Account exists and is enabled	Cannot sign in at all
2	Usage location is set	Licence never assigns; no services at all
3	Member of the licensing group	No licence, no assignment error either
4	Licence assigned without error	Some or no services provisioned
5	Mailbox provisioned	"No mailbox associated with this account"
6	MFA registered	Blocked at the second factor on first sign-in
7	Device enrolled and compliant	Conditional Access blocks everything on the laptop
8	Group memberships for shared resources	Signs in fine, cannot reach the team's files

Items 2 and 3 are the ones that most often go missing on accounts created manually,

out of hours, or ahead of an HR record.

Compare against a colleague who started the same day. Two people from one intake,

one working and one not, turns a vague provisioning question into a specific

difference — usually visible in one read of the user properties.

Then:

User properties — enabled, usage location, licences, assignment errors.
Group memberships — licensing group present, assignment result.
Mailbox properties — does the mailbox object exist?
Sign-in logs — is the account authenticating at all, and where does it stop?

hour. Three days is not a delay, it is a failure.

Group-based licensing — this creates a second assignment that outlives the user.

Resetting the password. If they can sign in, the credential works. Do not add

a new one to a first-day user's list of things to remember.

Closing when the licence appears. Teams in particular lags. Confirm with the

user that they can actually work.

A new starter who cannot work usually thinks they have done something wrong, and is

reluctant to keep asking. Say explicitly that it is not their fault, what is

happening, and roughly when. Then go back to them rather than waiting for them to

chase.