I'm curious about how companies handle the onboarding of new employees, especially when it comes to providing them with login credentials and setting up multi-factor authentication (MFA). Currently, we give our new hires their login details and company devices on their first day. However, our HR department wants to simplify this process by emailing login details to new hires' personal email accounts. Is this standard practice in other companies? How do you manage MFA setup while ensuring security?
5 Answers
Totally agree with keeping credentials secure! We have a process where we send a one-time password to the new hire's work email, and they're required to change it on the first login. Additionally, we've automated a lot of our onboarding processes. The HR system triggers account creations and notifications, and we make sure to have a strong procedure in place for MFA setup.
We’ve found that the best approach is to create accounts in advance, but keep them disabled until the new hire's first day. Then, we send a temporary password through a secure internal system, and guide them through the MFA process in person or via a secure method. It's super important to keep that communication secure to avoid any mishaps!
Sending login info to personal emails is a disaster waiting to happen! We don't do that at my workplace. New hires get their credentials on their first day, along with a secure guide that walks them through logging in and setting up MFA. Having them set everything up in-person or via a video call ensures that they're ready to go without any security breaches.
From what I've seen, emailing login credentials is pretty risky. Ideally, new hires should receive their credentials via a secure onboarding platform. We also offer a step-by-step guide for MFA setup that they have access to upon their start date. Having something in place that guides them through the process makes everything smoother and helps avoid confusion.
Sounds like your HR has some unique methods! In my experience, key security measures like MFA should be done face-to-face or at least over a secure channel. We usually onboard remotely, but we have a support person guide the new hire through the MFA setup. Emailing login info to personal accounts is a definite no-no; it opens the door for potential security issues. Instead, we have a secure portal set up for them to receive their credentials safely.

Related Questions
Can't Load PhpMyadmin On After Server Update
Redirect www to non-www in Apache Conf
How To Check If Your SSL Cert Is SHA 1
Windows TrackPad Gestures