How do you securely share initial passwords with remote new hires?

Generate a unique random temporary password for each person. Send the username and setup instructions separately, then deliver the password through an expiring, one-time secret-sharing link. A password manager's sharing feature or a self-hosted tool can do this.

Require a password change at first sign-in and have the new hire enroll in MFA and self-service password reset right away. Send the link to a contact address or number already confirmed during hiring.

If you're using Microsoft Entra, look at Temporary Access Pass. You can give the new hire a time-limited code to bootstrap sign-in and register their authentication methods, rather than handing out an initial password.

Check the flow against your conditional access and enrollment policies first. MFA setup can be awkward if your policies require an existing MFA method to add a new one.

I'd have the help desk or onboarding team walk the person through first sign-in, password change, and MFA enrollment. Make sure there's a reliable way to verify the new hire before sharing or resetting credentials. A manager's name alone may be easy to find.

Don't use one generic starting password for everyone, even if the system makes them change it. Until each person signs in, that shared password is known by more people than it needs to be. Use a different random temporary credential for every account.

Consider limiting what a new account can reach until the hire is on a company-managed device. If the device hasn't arrived, orientation and training can still happen while access to sensitive resources stays restricted.