How to set up a new laptop properly for a business user

Before the box is opened

Good setup starts with the order. Confirm the laptop comes with Windows 11 Pro, the agreed memory and storage, and the right warranty. Ask the supplier to register it with Windows Autopilot or Apple Business Manager if you use them, so it is tied to your organisation from the factory. Make sure the person's Microsoft 365 account and licence exist, and that they belong to the right groups for shared mailboxes, Teams and file access.

Write down the role's standard software and settings in advance. A short checklist per role, such as accounts, sales or operations, stops each setup being reinvented and means nothing is forgotten when someone starts on a Monday morning with a client meeting at nine.

Sign in with the work account, not a personal one

The laptop should be joined to Microsoft Entra ID and signed in with the staff member's work account. Avoid creating a local account or signing in with a personal Microsoft account, because that ties the device to an individual rather than the business and makes it much harder to manage or recover. If Autopilot is set up, this happens automatically when the user signs in for the first time.

Set up Windows Hello with a PIN and, where the hardware supports it, a fingerprint or face sign-in. Confirm multi-factor authentication is active on the account. Staff should never be local administrators on their own laptops; if they occasionally need to install approved software, provide that through the company portal or a support request instead.

Security that should be on before handover

Turn on BitLocker encryption and make sure the recovery key is stored in your Microsoft tenant, not on a sticky note or in the user's personal account. Install and confirm your endpoint protection is reporting. Check the Windows firewall is on and that the device appears as compliant in your management console.

Run Windows Update until nothing is left to install, including driver and firmware updates from the manufacturer. A brand-new laptop is often months behind on updates because it sat in a warehouse. Getting that out of the way before the user receives it avoids a long, frustrating update cycle on their first morning.

Apps, files and printers

Install Microsoft 365 apps and anything else the role needs, preferably pushed from the management tool so every laptop gets the same versions. Remove manufacturer trialware and anything else that isn't required. Fewer apps means fewer updates, fewer conflicts and a smaller target for attackers.

Set up OneDrive with known folder move so Desktop, Documents and Pictures sync to the cloud, and confirm the user can see the SharePoint libraries and Teams they need. Add the office printers with the correct drivers and default settings, such as black and white and double-sided. Test a print and a scan before handing over.

The handover

Spend fifteen minutes with the person when they get their laptop. Show them how to sign in, where their files are saved, how to connect to the dock and screens, how to join a Teams meeting and how to ask for help. Confirm their email, signature, shared mailboxes and calendar look right, and that they can open the business applications they use daily.

Record the handover in your asset register: who has the laptop, its serial number, the date and any accessories issued, such as a charger, dock or headset. If staff are expected to sign an acceptable use policy for company devices, this is the moment to do it.

Make it repeatable

The goal is that every laptop in the office ends up configured the same way, and that the steps live in your management tool rather than one person's head. Policies applied centrally keep settings consistent, and the next setup takes a fraction of the time. When someone leaves, the same system lets you wipe and reassign the device cleanly.

If you're setting up one or two laptops a year by hand, a written checklist is enough. Once you're past a handful, central management with Intune and Autopilot starts to save real time and closes the gaps that manual setups always leave behind.

Before the device goes out, give it a last check from the user's point of view. Sign in as them, open Outlook, a Teams chat and a SharePoint library, print a page and plug into a dock. Five minutes of testing catches the missing shared mailbox or wrong default printer that would otherwise become the first support request of their first day, and it sets the tone for how IT works in your business.