Independent guidance for making smarter, safer decisions across the Apple ecosystem.
A new Mac is easy to unbox. The harder work is making sure the company owns the right accounts, the employee can do their job, and access can be removed cleanly later. Treat onboarding and offboarding as one lifecycle. If a step cannot be reversed at departure, decide who owns it at setup.
Before the employee receives the Mac
Record the serial number, purchaser, assigned employee, warranty status, and location. If the device is company-owned and uses Apple Business Manager, confirm its assignment to the intended MDM. Decide whether the person needs a standard or administrator account, which Apple Account model applies, and which business identity will provide mail and file access. Keep a recovery path for FileVault and document who may retrieve it.
Prepare a verified backup strategy and a list of approved apps. Avoid handing out a shared administrator password or signing everyone into one personal Apple Account. If the employee is remote, write down the shipping, first-login, and support process before the package arrives.
First-day acceptance check
Ask the employee to sign in, enroll if required, and open the tools they actually use: mail, calendar, collaboration, cloud files, VPN, printer, and creative or line-of-business apps. Confirm updates, encryption, and backup are active. Test a real file open and save, not merely an app icon. Show the employee where company files belong and which personal storage locations are outside policy.
A short acceptance record should identify the device, employee, date, apps tested, remaining issues, and who will resolve them. Our new employee Mac setup article covers the device setup in more detail.
Start offboarding before the last day
Coordinate with the business owner and the person responsible for HR or legal retention. Identify mail, shared documents, local-only files, app subscriptions, passwords, and MFA methods. Preserve required business data and verify another authorized person can open it. Then revoke access in the identity provider, business apps, VPN, and MDM according to the agreed timing. Do not assume disabling a single Apple Account removes every SaaS session.
Recover the Mac and accessories, inspect its condition, confirm the correct serial number, and verify that data has been handed off. Only then erase and prepare it for reuse through the organization’s approved workflow. A remotely issued erase command is a last step after ownership and data retention are confirmed; it can eliminate the only copy of a file.
Keep the checklist short enough to use
Maintain one record per employee with dates and sign-off for: device assignment, enrollment, encryption key, identity access, apps, backup, data location, return, access revocation, data handoff, and reset. Review exceptions after each departure. That feedback is more valuable than a lengthy policy nobody follows.
Independent guidance for making smarter, safer decisions across the Apple ecosystem.
