← Drew Fashion Studio Runbook · Drew Fashion Studio
An e-commerce assistant starts Monday at Drew Fashion Studio. She needs email, Teams, the Studio SharePoint site and the product photography library — but not finance.
01 Confirm the role and its access profile Job title, manager, start date, applications, data they need and the licence tier that covers it. Written confirmation from the business owner or manager. 02 Create the account and assign the licence by group Named account, correct naming convention, licence granted through group membership rather than direct assignment. 03 Enforce MFA and register two methods Require MFA enrolment at first sign-in and insist on a backup method so a lost phone is not an outage. 04 Grant data and application access via groups only Add to the role's security groups. Never grant direct per-user permissions on libraries or shares — they are invisible at offboarding. 05 Build and enrol the device from a known baseline Clean build, management enrolment, disk encryption, update policy, endpoint protection, standard and role applications. 06 Provision third-party SaaS seats from the application register Walk the register: every tool the role uses gets an account created under the company identity, not a personal one. 07 Add to mailboxes, teams, calendars and distribution lists Shared mailboxes by delegation, not shared passwords. Confirm the role's meeting and channel memberships. 08 Run the first-day briefing How to raise a ticket, security expectations, what to do about suspicious email, where files live and who to ask. 09 Record the asset and close the loop Asset register entry with serial and assignment, ticket notes, and confirmation from the manager that day one worked.