Start with the role, not the login
Before you create a new account, decide what the person actually needs to do. A new accounts clerk in Woodstock will need different access from a branch manager in Durban or a remote sales rep working from home during load-shedding. When the role is clear, the setup is faster and the risk of over-sharing is much lower.
Use the initial security review to confirm what applications the user should reach, whether they need shared passwords or personal access, and who must approve each step. This is also the point to check if the person is replacing someone, joining a new team, or moving between departments.
- Confirm job title and department
- List every app the person needs on day one
- Note whether access should be view only, edit, or admin
- Identify the manager who signs off on access
Build the account with the right security controls
Once the role is confirmed, set up the user account with a strong password policy and the right authentication rules. For small teams, this should be done the same day the person starts, not after they have already asked colleagues for logins. That kind of sharing creates confusion and can lead to lost control if someone leaves later.
Set the account up so it matches your business rules from the start. If your team uses mobile phones for verification, make sure the number is current. If staff work between office and home, confirm their device is secure and that they know how to sign in from both places. A clean setup saves a lot of admin later.
- Assign the user to the correct team or group
- Turn on multi-factor authentication where required
- Set password rules that match company policy
- Record the start date and the manager responsible
Give access by group, not by guesswork
Good access control depends on structure. Rather than handing out permissions one by one, map the user to the right vaults, folders or groups. That makes it easier to manage staff in Johannesburg, Pretoria, Cape Town and remote teams without having to rebuild access every time someone changes role.
Permission mapping should match what people need for daily work. For example, a new marketing coordinator may need access to social media tools, design platforms and shared files, but not payroll or banking. Keep admin rights limited to the people who truly need them.
- Use role-based access wherever possible
- Keep sensitive records in separate vaults
- Review inherited permissions before approving them
- Remove access that is not needed for the first 30 days
Train new users before they start sharing passwords
Even a well-set account can go wrong if the user does not know how to use it. A short onboarding session helps staff understand how to store passwords, find shared logins and avoid risky habits like sending credentials over chat. For teams in Durban, Gqeberha or Stellenbosch, remote training works well when people cannot all sit in one room.
Keep the training practical. Show how to sign in, how to request access, how to lock a session when stepping away, and what to do if a password is forgotten. The aim is to build good habits from day one, not to overwhelm new staff with policy language.
- Explain how to save and retrieve credentials
- Show the right way to request access changes
- Cover safe use on office and personal devices
- Make sure the user knows who to contact for help
Check the offboarding path before the first login
New user setup should always link back to the offboarding process. If someone leaves later, you need to know exactly which accounts to close, which shared access to revoke and which approvals to keep. Planning this early avoids gaps that can leave old access hanging around for weeks.
It is worth documenting who owns each account, who can approve changes and what happens if a device is lost or stolen. This matters even more for small businesses where one person may hold several responsibilities. Clear records make the handover simple and cut down on admin during busy periods.
- Record account owner and approver
- Note which systems are business critical
- Document what happens when staff change role
- Review access again after the first 30 days
Use a short checklist for every new starter
A standard checklist keeps onboarding consistent across the business, whether the person is in Woodstock or joining remotely from elsewhere in South Africa. It also helps your admin team spot missing steps before the new user starts asking for access they should have already received. Small businesses often run on tight timeframes, so a repeatable process is worth a lot.
Use the checklist below for each new starter and keep it with your admin records. If anything changes, update the list straight away so the next hire gets the same standard of secuirty and support.
- Role confirmed and signed off
- Account created and secured
- Access groups assigned
- Training completed
- Manager notified
- First week review booked
