Employee Onboarding Procedure

Owner: Rory
Triggered by: Accepted offer letter, HR notification, or manager request
Tenant: Azure Entra ID PROD — ciriusgroup.com (d477c9f8)

This is the authoritative cross-system checklist for bringing a new employee online. Work top-to-bottom. Order matters — AD must propagate to Entra before downstream systems are configured, and HIPAA training must be complete before access to any PHI-adjacent system is granted.

For the reverse of this process, see Employee Offboarding.

Access Tiers

Tier	Who	Systems
Standard	All employees	M365, OneLogin SSO apps, Twingate (standard resources), Keeper (department vault)
IT / Security	IT and security staff	Standard + Azure Portal Reader, AWS read-only, Entra admin roles (PIM-gated), Panorama read-only
Admin / Privileged	Rory only	PIM-gated elevated roles, break-glass adjacent access

Section 1 — Pre-Day-One Checklist

Collect all of the following before touching any system. Missing information causes cascading errors downstream (mismatched UPNs, wrong group assignments, license waste).

[ ] Legal first and last name — must match HR records exactly; used for AD displayName and UPN
[ ] Work email username — confirm format: firstname.lastname@ciriusgroup.com; flag any disambiguation needs (duplicate names)
[ ] Start date — determines account activation timing; create account 1–2 business days before start
[ ] Department — determines Keeper vault assignment, OneLogin app bundle, and Twingate group
[ ] Manager — for group membership, mailbox delegate setup if needed
[ ] Access tier — Standard / IT-Security / Admin-Privileged (see table above)
[ ] Device status — corporate-issued (Intune auto-enrollment via Autopilot) or BYOD (MAM enrollment only)
[ ] Job title — set on AD object and Entra profile
[ ] HIPAA training confirmation required — note this; access gates depend on it

Do not proceed past Section 2 until all fields above are confirmed.

Section 2 — Account Creation Sequence

2a. Create On-Premises Active Directory Account

AD is the identity source of record. Entra Connect syncs to Entra ID within 30 minutes. Create the AD account first — everything else depends on the Entra object existing.

powershell

# Run on a domain controller or from a machine with RSAT AD tools
# Adjust OU path to match department
New-ADUser `
  -Name "Firstname Lastname" `
  -GivenName "Firstname" `
  -Surname "Lastname" `
  -SamAccountName "firstname.lastname" `
  -UserPrincipalName "firstname.lastname@ciriusgroup.com" `
  -DisplayName "Firstname Lastname" `
  -Title "Job Title" `
  -Department "Department Name" `
  -Manager "manager.name" `
  -Path "OU=Users,OU=Department,DC=ciriusgroup,DC=local" `
  -AccountPassword (ConvertTo-SecureString "TempPass123!" -AsPlainText -Force) `
  -ChangePasswordAtLogon $true `
  -Enabled $true

After creation:

[ ] Verify the account appears in Active Directory Users and Computers
[ ] Add to appropriate AD security groups (department group, standard users group)
[ ] For IT/Security tier: add to IT-Staff AD group (controls Entra admin role eligibility via PIM)

Wait for Entra Connect sync before proceeding. Default sync cycle is 30 minutes. To force an immediate sync from a domain controller or Entra Connect server:

powershell

# Run on the Entra Connect server
Start-ADSyncSyncCycle -PolicyType Delta

Verify sync completed:

[ ] Entra ID → Users — user appears with UPN firstname.lastname@ciriusgroup.com
[ ] Account shows Sync type: On-premises Active Directory

2b. Assign Entra Licenses

Once the account is visible in Entra, assign the license. Without it, M365 apps, Teams, and Exchange mailbox provisioning all fail.

Portal method:
Entra ID → Users → [user] → Licenses → Assignments → Add → Microsoft 365 Business Premium

PowerShell method:

powershell

# Connect to Microsoft Graph
Connect-MgGraph -Scopes "User.ReadWrite.All", "Directory.ReadWrite.All"

# Find the SKU ID for M365 Business Premium
Get-MgSubscribedSku | Where-Object { $_.SkuPartNumber -eq "SPB" } | Select-Object SkuId

# Assign the license (replace SkuId with value from above)
Set-MgUserLicense -UserId "firstname.lastname@ciriusgroup.com" `
  -AddLicenses @{SkuId = "<sku-id-from-above>"} `
  -RemoveLicenses @()

After assignment:

[ ] Teams mailbox provisioned — visible in M365 Admin Center → Exchange → Mailboxes
[ ] User can access https://portal.office.com (after MFA setup in §3)
[ ] Usage location set (required for license assignment): Entra → [user] → Edit properties → Settings → Usage location → United States

2c. OneLogin — Account + App Assignments

OneLogin is provisioned via SCIM from Entra. Once the Entra account and license exist, the SCIM connector creates the OneLogin user automatically within a few minutes.

Verify auto-provisioning:

[ ] OneLogin Admin → Users → [user] → Status: Active

If SCIM hasn't run yet, create manually:
OneLogin Admin → Users → New User → fill UPN, email, name → Save

App assignments — assign the bundle for the user's department:

OneLogin Admin → Users → [user] → Applications → Add Apps

Department	Standard App Bundle
All staff	M365, Keeper SSO, KnowBe4, Zendesk (end-user)
IT / Security	Above + Zendesk (agent), Panorama (read-only), Arctic Wolf portal
Operations	Above standard + department-specific apps

[ ] Apps assigned match the user's access tier
[ ] Send OneLogin welcome email: OneLogin Admin → [user] → More Actions → Send Invitation

2d. Keeper — Department Vault Access

Keeper uses SSO via Entra/OneLogin. The account exists once OneLogin is live.

Add to department vault:
Keeper Admin Console → Shared Folders → [Department Vault] → Users → Add User → firstname.lastname@ciriusgroup.com

[ ] User added to [Department] — Shared folder
[ ] Send Keeper invite: Keeper Admin Console → Users → [user] → Send Invitation
[ ] Verify user appears as Active after they accept the invite and log in

IT/Security tier additional access:

[ ] Add to Infrastructure — Shared folder (read-only initially)
[ ] Do not add to Break-Glass folder — that is Rory only

2e. Twingate — Access Group Assignment

Twingate access is controlled by Entra group membership. Add the user to the appropriate Entra group and Twingate picks it up on the next sync (near-real-time).

Entra group assignments for Twingate:

Access Level	Entra Group
Standard employee	`AllStaff`
IT / Security	`AllStaff` + `PrivilegedUsers`

Add via Entra portal: Entra ID → Groups → [group name] → Members → Add members

Or via PowerShell:

powershell

# Add to AllStaff
Add-MgGroupMember -GroupId "<AllStaff-group-id>" `
  -DirectoryObjectId (Get-MgUser -UserId "firstname.lastname@ciriusgroup.com").Id

# Add to PrivilegedUsers (IT/Security tier only)
Add-MgGroupMember -GroupId "<PrivilegedUsers-group-id>" `
  -DirectoryObjectId (Get-MgUser -UserId "firstname.lastname@ciriusgroup.com").Id

[ ] User appears in Twingate Admin Console → Users → [user] → Groups (may take 5–10 min after Entra group add)
[ ] Twingate access is blocked until Intune device compliance is confirmed — Compliance gate is enforced; see §2h

2f. KnowBe4 — Add User and Assign HIPAA Training

HIPAA training must be completed before access to any PHI-adjacent system is granted. This is a compliance requirement, not a suggestion. Do not skip ahead.

Add the user:
KnowBe4 Admin Console → Users → Add User → fill name and email → Save

Assign HIPAA training:
KnowBe4 → Training → Campaigns → [HIPAA New Employee Campaign] → Add Users → [user] → Save

[ ] User added to KnowBe4 with correct email (firstname.lastname@ciriusgroup.com)
[ ] HIPAA New Employee training campaign assigned
[ ] Enrollment notification email sent to user
[ ] Note: training completion is gated in §4 — do not grant PHI-adjacent access until §4 is cleared

2g. Zendesk — Create Account

Standard employees (end-user, ticket submission only):
Zendesk Admin → People → End Users → Add User → fill name and email

IT/Security staff (agent, ticket management):
Zendesk Admin → People → Team Members → Add Team Member → fill name, email, role → Agent

[ ] Account created with the correct role (end-user vs. agent)
[ ] If agent: assign appropriate group (IT, Security, General) in Zendesk → [user] → Groups
[ ] Zendesk welcome email sent

2h. Intune — Device Enrollment

Intune compliance is required for Twingate access. A device that is not enrolled or not compliant cannot connect to any Twingate-protected resource.

Corporate device (Autopilot):

The device should auto-enroll via Windows Autopilot on first boot with the user's Entra credentials. Verify:

[ ] Intune Admin Center → Devices → [device name] → Enrollment date — shows today
[ ] Device compliance status → Compliant

If Autopilot enrollment fails, send a manual enrollment link:
Intune Admin Center → Devices → Enroll Devices → Windows Enrollment → send instructions to user, or direct them to:
https://aka.ms/enroll — log in with @ciriusgroup.com credentials

BYOD / Mobile (MAM only):
Intune Admin Center → Apps → App Protection Policies — user must install Intune Company Portal and enroll for MAM. MAM does not give full device management but enforces app-level controls (PIN, copy-paste restrictions, remote wipe of corp data).

[ ] Mobile MAM: user installs Company Portal, logs in with @ciriusgroup.com, accepts policy

After enrollment:

[ ] Device appears in Intune Admin Center → Devices → All Devices
[ ] Compliance status shows Compliant (not Pending, Not Compliant, or Not Evaluated)
[ ] If compliance shows Pending: allow 15 minutes for policy evaluation to complete

Twingate will not pass the compliance gate until this is green. Confirm before troubleshooting Twingate connectivity issues.

2i. Cortex XDR — Verify Agent Installation

Cortex XDR agent is deployed via Intune policy push. If the device enrolled in Intune correctly, the agent installs automatically within ~1 hour of first enrollment.

Verify installation:
Cortex XDR Console → Endpoints → [search by hostname or user] → Status: Connected

If the agent is not showing after 2 hours:

Verify Intune device enrollment is complete and compliant
Check Intune Admin Center → Devices → [device] → Device configuration → Cortex XDR policy → Last check-in
If the policy shows an error, check the Cortex XDR Intune app deployment status:
Intune → Apps → [Cortex XDR] → Device install status → [device name]
[ ] Endpoint appears in Cortex XDR console
[ ] Status: Connected
[ ] Policy group: verify the endpoint is in the correct Cortex XDR policy group (Standard Users or IT-Security depending on tier)

Section 3 — MFA Setup

MFA is enforced by Conditional Access for all users. The user will be prompted to register MFA on first login. Walk them through this on or before day one.

Standard users — TOTP acceptable:

User logs into https://portal.office.com with their UPN and temporary password
Conditional Access triggers MFA registration prompt: "More information required"
Direct them to: https://aka.ms/mfasetup
Recommended methods (in order of preference):
- Microsoft Authenticator app (push notifications, number matching) — preferred
- TOTP hardware token or other authenticator app — acceptable
User registers the authenticator app, verifies a test prompt works
Register SSPR (Self-Service Password Reset) at the same time: https://aka.ms/ssprsetup
- Requires at least 2 authentication methods registered (MFA app + backup email or phone)

[ ] MFA registered and tested — user can approve a prompt from their device
[ ] SSPR registered — user can reset their own password without calling Rory
[ ] User shown how to respond to unexpected MFA prompts (deny + report)

IT/Security and privileged users — FIDO2 or Windows Hello for Business required:

Phishing-resistant MFA is enforced by Conditional Access for all privileged role activations. TOTP does not satisfy this requirement for PIM-gated roles.

Complete standard TOTP registration above first (needed for initial access)
Register a FIDO2 security key:
https://mysignins.microsoft.com/security-info → Add method → Security key → USB device or NFC tap
Or configure Windows Hello for Business:
Windows Settings → Accounts → Sign-in options → Windows Hello for Business → Set up PIN → follow prompts
Test PIM activation using the FIDO2/WHfB method — it must succeed before the privileged setup section (§6) can proceed

[ ] FIDO2 key or Windows Hello registered
[ ] Test PIM activation succeeds with phishing-resistant MFA (not TOTP)

Section 4 — HIPAA Training Gate

No access to PHI-adjacent systems until this section is complete.

PHI-adjacent systems include but are not limited to: any clinical data repositories, shared folders containing patient data, systems connected to the DDE Medicare environment, and any system accessible via Twingate that processes or stores health information.

How to verify KnowBe4 completion:

KnowBe4 Admin Console → Users → [user] → Training → [HIPAA New Employee Campaign] →
Status must show: Completed with a completion date

Or via Reports:
KnowBe4 → Reports → Training Reports → User Progress → filter by user name → check completion percentage = 100%

[ ] KnowBe4 HIPAA training: 100% complete, completion date recorded
[ ] Log the completion in compliance/training-completion-log.md — add a row with name, date completed, and training title
[ ] Only after this checkbox is marked: proceed to grant access to PHI-adjacent resources

If the user has not completed training by their start date, do not grant PHI-adjacent access. They can have M365, Teams, and general productivity tools, but not Twingate access to clinical or data systems, and not DDE environment access.

Section 5 — First-Day Verification Checklist

Run through this on or by end of day one. If any item is red, resolve it before the employee goes home — incomplete access states are harder to debug after the fact.

Identity

[ ] User can log into https://portal.office.com with firstname.lastname@ciriusgroup.com
[ ] MFA prompt works — user approves or denies a test push
[ ] SSPR configured — user can access https://aka.ms/ssprsetup and sees methods registered
[ ] Entra account shows Account enabled: Yes, On-premises sync enabled: Yes

M365

[ ] Teams is accessible and user can send a test message
[ ] Outlook/Exchange mailbox is provisioned — user can send and receive email
[ ] SharePoint accessible (if department uses it)

Keeper

[ ] User can log into Keeper via SSO (OneLogin → Keeper)
[ ] Department shared folder is visible and accessible
[ ] User has saved their own vault master password (Keeper's encryption key — not stored anywhere by Cirius)

Twingate

[ ] Twingate client installed on device (https://www.twingate.com/download, network name: cirius)
[ ] User logs in with @ciriusgroup.com SSO
[ ] Device passes compliance check (green status in Twingate client)
[ ] User can reach at least one internal resource (test: attempt to connect to an internal resource via Twingate → should succeed if compliant)

If Twingate shows device not compliant:

Verify Intune compliance status (§2h)
Allow up to 15 minutes for compliance sync between Intune and Twingate
If still not compliant after 15 min: check Intune non-compliance policy — see Intune Non-Compliance Investigation

Intune

[ ] Device listed in Intune Admin Center → Devices → All Devices
[ ] Compliance status: Compliant
[ ] Last check-in: within last 2 hours

Cortex XDR

[ ] Endpoint appears in Cortex XDR console → Endpoints
[ ] Status: Connected
[ ] No alerts on the new endpoint from the Cortex XDR agent itself indicating install issues

KnowBe4

[ ] User appears in KnowBe4 → Users
[ ] HIPAA training campaign assigned and enrollment email received by user
[ ] If training is already complete (unlikely on day one): completion logged in compliance/training-completion-log.md

OneLogin

[ ] User can access https://ciriusgroup.onelogin.com
[ ] Assigned apps appear in the OneLogin portal
[ ] SSO into at least one app works (e.g., Keeper or Zendesk)

Section 6 — Privileged Access Onboarding (IT/Security Staff Only)

Skip this section entirely for standard employees.

6a. Entra PIM Role Assignments

PIM (Privileged Identity Management) gates all elevated roles. Roles are eligible (not active) — the user must activate them through PIM each time they need elevated access. Eligible assignments expire and must be renewed annually.

Assign eligible roles in Entra PIM:
Entra ID → Identity Governance → Privileged Identity Management → Entra roles → Assignments → Add assignments

Role	Scope	Notes
Global Reader	Tenant (PROD)	Read-only view of all Entra objects — assign on day one
Security Reader	Tenant (PROD)	Read Defender, Entra security posture
User Administrator	Tenant (PROD)	PIM-gated; activate only when managing user accounts
Security Administrator	Tenant (PROD)	PIM-gated; activate only for CA policy changes, security settings
Azure Portal Reader	Subscription(s)	Direct Azure RBAC assignment — Reader role, not PIM-gated

[ ] Global Reader eligible assignment created in PIM
[ ] Security Reader eligible assignment created in PIM
[ ] User Administrator eligible assignment created in PIM (if warranted — confirm with Rory)
[ ] Security Administrator eligible assignment created in PIM (if warranted — confirm with Rory)
[ ] Azure Portal Reader RBAC role assigned on relevant subscriptions

Do not assign Global Administrator or Privileged Role Administrator to new IT staff. These require explicit approval and are rare. Contact Rory if the role genuinely requires it.

Activating a PIM role (user's perspective):
Entra ID → PIM → My roles → Eligible → [role name] → Activate → provide justification → activate
Duration: set to minimum needed (e.g., 2 hours for a specific task)
MFA: phishing-resistant MFA required (FIDO2 or Windows Hello — TOTP will not satisfy the CA policy)

[ ] Walk the new engineer through their first PIM activation as a hands-on exercise
[ ] Verify they can activate Global Reader and deactivate it successfully

6b. AWS Read-Only Access

IT/Security staff need AWS read-only access for incident investigation and observability.

Add the user to AWS IAM Identity Center:
AWS Console (Management account, 206820231356) → IAM Identity Center → Users → Add user

Assign to permission set:
Identity Center → Permission Sets → ReadOnlyAccess → AWS accounts → Assign users → [user]

Accounts to assign read-only access to: all 7 accounts (Management, Backup, Dev, Identity, Logging, Networking, Prod)

[ ] User added to IAM Identity Center with SSO portal email = firstname.lastname@ciriusgroup.com
[ ] ReadOnlyAccess permission set assigned to all relevant accounts
[ ] User sets up AWS CLI SSO profile — see AWS Account Access Guide
[ ] Test: aws sts get-caller-identity --profile prod returns successfully

6c. Panorama Read-Only Access

Panorama manages the Palo Alto firewall fleet. New IT/Security staff get read-only access. Write access is granted only after demonstrated familiarity with the environment.

Panorama Admin Console → Device → Administrators → Add
Set role to Custom → configure read-only access to device groups and templates
Or use the pre-built analyst-readonly admin role if it exists.

[ ] Panorama account created with read-only role
[ ] Credentials stored in Keeper → Infrastructure — Shared folder
[ ] User can log in and view the firewall policy without making changes

6d. Break-Glass Awareness Briefing

Before any IT/Security engineer operates independently, they must understand the break-glass account policy.

Cover the following in a verbal briefing (document that it happened):

Break-glass accounts are never to be used for routine tasks. These are emergency-only: cirius-breakglass@ciriusgroup.com, cirius-breakglass@ciriusdde.com, and the 3 AD break-glass accounts.
Any activity on a break-glass account fires a CRITICAL alert in SecOps. There is a hard API block preventing suppression — it cannot be silenced, ever.
New IT staff do not have the break-glass credentials. Those are in Keeper → Break-Glass folder, Rory-only access. If a break-glass situation arises, escalate to Rory.
18 total break-glass accounts are monitored: AD (3), Entra PROD (2), Entra DDE (2), AWS root (7 accounts), Palo Alto (4 firewalls). See Break-Glass Procedure.

[ ] Break-glass briefing completed — note date in onboarding ticket
[ ] New engineer has read Break-Glass Procedure
[ ] Confirmed: new engineer does not have access to Break-Glass Keeper folder

6e. SecOps Platform Access

IT/Security staff access the SecOps platform via Entra SSO. The platform at secops.bedrockcybersecurity.org uses MSAL PKCE for browser auth — no separate account needed.

[ ] Verify the user is in the SecOps-Analysts Entra group (group ID: ffdf1dcb or check current ID in Entra)
[ ] User can log into secops.bedrockcybersecurity.org and sees the Incidents queue
[ ] Walk through IT Engineer Onboarding for the full first-week operations guide

Section 7 — 30-Day Follow-Up

At the 30-day mark, verify the access footprint is clean and no stale or over-permissioned access exists.

Access Review

[ ] Entra group memberships — confirm all groups are appropriate for the role; remove any temp groups added during onboarding
[ ] OneLogin app assignments — confirm no apps were added for temporary onboarding tasks and left assigned
[ ] Keeper vault access — confirm the user is in only the folders their role requires
[ ] Twingate group assignments — confirm standard vs. privileged access matches current role
[ ] PIM eligible assignments (IT/Security only) — confirm roles are scoped correctly; no over-assignment that wasn't caught on day one
[ ] AWS permission sets (IT/Security only) — confirm ReadOnly is still appropriate; escalate to Rory if expanded access is now needed

Compliance Check

[ ] KnowBe4 HIPAA training — confirm completion at 100%; if not yet complete, block PHI-adjacent access until done and escalate to manager
[ ] Training logged in compliance/training-completion-log.md — row exists with completion date
[ ] Intune compliance — Intune Admin Center → Devices → [device] → Compliance status: Compliant; if non-compliant, follow Intune Non-Compliance Investigation
[ ] Cortex XDR — Endpoint still shows Connected; no policy gaps or missing coverage

Access Adjustments

If the user's role has changed since onboarding (department transfer, expanded responsibilities, promotion):

Treat access additions as a mini-onboarding: document the change, add to the appropriate groups
Treat access removals as a mini-offboarding: remove from groups immediately, verify downstream system sync
Do not accumulate access — remove what is no longer needed even if the user hasn't asked

Completion Checklist

Use this table to track the full onboarding and keep a copy for audit evidence.

Step	System	Completed	Notes
1	Pre-day-one info collected
2a	AD account created, synced to Entra
2b	M365 Business Premium license assigned
2c	OneLogin account active, apps assigned
2d	Keeper — added to department vault, invite sent
2e	Twingate — Entra groups assigned
2f	KnowBe4 — user added, HIPAA training assigned
2g	Zendesk — account created (correct role)
2h	Intune — device enrolled and compliant
2i	Cortex XDR — agent installed and connected
3	MFA registered (TOTP for standard; FIDO2/WHfB for IT/Security)
3	SSPR registered
4	KnowBe4 HIPAA training completed (100%)
4	Completion logged in training-completion-log.md
5	First-day verification — all systems green
6a	PIM eligible roles assigned (IT/Security only)
6b	AWS read-only access configured (IT/Security only)
6c	Panorama read-only account created (IT/Security only)
6d	Break-glass briefing completed (IT/Security only)
6e	SecOps platform access verified (IT/Security only)
30d	30-day access review completed
30d	Intune compliance verified at 30 days
30d	KnowBe4 completion confirmed at 30 days

Employee Offboarding — the reverse of this process; run it on the employee's last day
Entra Identity Operations — Entra account management details
IT Engineer Onboarding — first-week operational guide for IT/Security staff
Twingate Operations — remote access group management, compliance enforcement
Intune Non-Compliance Investigation — what to do when a device fails compliance
Break-Glass Procedure — emergency access procedures
Keeper Credential Guide — shared folder structure, vault access management
OneLogin Operations — app assignment, SCIM sync, account management
Conditional Access Reference — MFA policies, phishing-resistant enforcement

Document History

Date	Change	Author
May 2026	Initial draft — full cross-system onboarding checklist: AD, Entra, M365, OneLogin, Keeper, Twingate, KnowBe4, Zendesk, Intune, Cortex XDR; HIPAA training gate; MFA setup; PIM/privileged access; 30-day follow-up.	Rory

Employee Onboarding Procedure ​

Access Tiers ​

Section 1 — Pre-Day-One Checklist ​

Section 2 — Account Creation Sequence ​

2a. Create On-Premises Active Directory Account ​

2b. Assign Entra Licenses ​

2c. OneLogin — Account + App Assignments ​

2d. Keeper — Department Vault Access ​

2e. Twingate — Access Group Assignment ​

2f. KnowBe4 — Add User and Assign HIPAA Training ​

2g. Zendesk — Create Account ​

2h. Intune — Device Enrollment ​

2i. Cortex XDR — Verify Agent Installation ​

Section 3 — MFA Setup ​

Section 4 — HIPAA Training Gate ​

Section 5 — First-Day Verification Checklist ​

Identity ​

M365 ​

Keeper ​

Twingate ​

Intune ​

Cortex XDR ​

KnowBe4 ​

OneLogin ​

Section 6 — Privileged Access Onboarding (IT/Security Staff Only) ​

6a. Entra PIM Role Assignments ​

6b. AWS Read-Only Access ​

6c. Panorama Read-Only Access ​

6d. Break-Glass Awareness Briefing ​

6e. SecOps Platform Access ​

Section 7 — 30-Day Follow-Up ​

Access Review ​

Compliance Check ​

Access Adjustments ​

Completion Checklist ​

Related Documents ​

Document History ​

Employee Onboarding Procedure

Access Tiers

Section 1 — Pre-Day-One Checklist

Section 2 — Account Creation Sequence

2a. Create On-Premises Active Directory Account

2b. Assign Entra Licenses

2c. OneLogin — Account + App Assignments

2d. Keeper — Department Vault Access

2e. Twingate — Access Group Assignment

2f. KnowBe4 — Add User and Assign HIPAA Training

2g. Zendesk — Create Account

2h. Intune — Device Enrollment

2i. Cortex XDR — Verify Agent Installation

Section 3 — MFA Setup

Section 4 — HIPAA Training Gate

Section 5 — First-Day Verification Checklist

Identity

M365

Keeper

Twingate

Intune

Cortex XDR

KnowBe4

OneLogin

Section 6 — Privileged Access Onboarding (IT/Security Staff Only)

6a. Entra PIM Role Assignments

6b. AWS Read-Only Access

6c. Panorama Read-Only Access

6d. Break-Glass Awareness Briefing

6e. SecOps Platform Access

Section 7 — 30-Day Follow-Up

Access Review

Compliance Check

Access Adjustments

Completion Checklist

Related Documents

Document History