How to Run Secure Online Employee Onboarding for Remote Hires

A remote hire's first day starts at home, with a laptop that arrived by courier. Nobody handed it over, nobody checked an ID at a front desk, and nobody walked the new hire over to the apps their team works in. Every check an office would have run that morning now has to happen before or at the first sign-in.

Online employee onboarding is how you bring a new hire into the company through remote tools, from e-signed paperwork and video orientation to the accounts, laptop, and access they need to do the job, with no office involved. The hardest part of that list is the identity work, confirming who the person is and deciding what they can reach. It's where remote starts stall or get exploited, because the building used to handle it for free.

For remote hires, that work now runs through a shipping box, a video call, and the first sign-in. Each part has a fix you can put in place this quarter. In this article, you will learn how to lock the laptop until they're verified, confirm their identity on that call, keep day-one access narrow, handle their requests in chat, and close onboarding with a 90-day access review.

Six identity checks the remote onboarding process has to rebuild

On a new hire's first morning at an office, the front desk, IT, the help desk, coworkers, and the manager each run a quiet check, and none of them would call it security. Some confirm who the person is, others limit what they can reach, and all of them help someone new get to work. Remote onboarding takes them all away, and every one needs a replacement that someone designs and owns.

We feel this more than most. Lumos is 100% remote, with a hub office in San Francisco, so nearly every person we hire opens their laptop at home on day one. A company without a lobby has to answer each of those quiet checks some other way.

The welcome, paperwork, and training sit with HR's employee onboarding program, and the full onboarding checklist puts HR's steps and these checks on one timeline. The six checks below follow the order they happen. As you read, mark which ones your current plan has replaced and who owns each. The checks nobody owns are where remote hires get stuck, or get in.

1. Handing over the laptop

When IT handed a laptop across a desk, it couldn't end up with anyone but the person standing there. A shipped laptop can. IT owns making it useless to anyone else until the new hire is verified.

2. Matching a face to an ID

The front desk checked a government ID against the face in front of it, often for someone the team had already met at an onsite interview. Remote hiring can skip both. IT or security, with HR's help, now has to see the person and their ID together before the account switches on, and the verification section below walks through that call.

3. Setting the first credential

A help desk tech set the first password with the new hire in the room. Online, the first credential goes out on that same live call, and IT owns making sure it lands on the managed laptop.

4. Limiting where a new hire can go

A badge opened some floors and kept a new hire out of the server room. Day-one access does that job now, and IT and app owners decide how narrow it starts and what waits for a time-bound request.

5. Showing a new hire the team's apps

When a coworker pointed out the team's apps, a new hire found the right tools without filing a ticket. A remote hire needs an app catalog and a request path in the chat tool instead, and IT and managers own both.

6. Spotting someone who doesn't belong

A manager would notice a stranger at a desk. On a remote team, the stranger shows up as a sign-in far from where the laptop shipped, or activity at hours nobody on the team works. Security and managers watch for those signals in the first weeks and run an access review around day 90.

Enroll and lock a remote new hire's laptop before it ships

In a virtual onboarding process, the laptop has to arrive before the first morning. It ships before anyone has checked the new hire's ID, to an address they supplied, and it's the most valuable thing you send during onboarding.

Make the laptop useless until the person is verified. Enroll it in your device management tool before it leaves the depot, so the first boot requires the corporate sign-in, and keep that sign-in closed until the live check in the next section.

Enrollment also speeds up the first morning, because the role's apps and settings install at that first sign-in with no help desk call. It pays off again when offboarding remote employees means getting the laptop back.

The Justice Department's case against an Arizona woman shows why the address still matters. From 2020 to 2023, she received laptops that U.S. companies shipped for their new remote hires and kept them running in her home. The companies believed the work was happening in the United States, while North Korean IT workers did it from abroad.

She helped those workers land jobs at 309 U.S. companies and shipped 49 laptops and other devices overseas. A search of her home in October 2023 turned up more than 90 laptops, and in July 2025 she was sentenced to 102 months in prison.

Before a laptop ships, confirm the address by phone, at the number recruiting has used throughout the process. Hold the shipment if they ask to send it somewhere else or the address changes after the offer. Neither step stops a determined fraud ring. The lock and the day-one check carry most of the weight.

On the day-one video call in the next section, IT compares the address on the new hire's ID with the one the laptop shipped to. A mismatch is a warning sign, though a match proves less than it seems, because a forged ID can carry any address. IDs also lag behind real moves, and a mismatch calls for a question and a recent lease or utility bill before the account opens.

Verify a remote new hire's identity before their account goes live

Every check in a typical remote hiring process tests something the candidate supplied, from the résumé and references to the face on a video interview. A video interview compares that face to a résumé, and nothing ties it to a document. Someone using a borrowed identity can pass every one of those checks.

Gartner's research gives a sense of scale. In a Gartner survey of 3,000 job candidates in the second quarter of 2025, 6% admitted to interview fraud, either posing as someone else or having someone pose as them.

Gartner advises recruiters to keep fraud checks running past the initial stage of hiring, with identity verification built into recruiting tools. Even then, the person a recruiter verified and the person who first signs in can differ. That's how a stand-in interview works. Remote employee onboarding is where you check the person who receives the account.

NIST's guidance on remote identity proofing shows what a strong check looks like. Under its final SP 800-63A-4, published in July 2025, a trained agent can confirm someone over live video against the photo on a validated ID, with controls against injected or altered video. A credential bound outside that session means confirming the person again. NIST wrote those rules for credential providers and federal agencies, but they make a sound model for a new hire's first sign-in.

Build the accounts as early as you like, but keep sign-in closed until the start time, and then open it only to a one-time code. On the first morning, the new hire joins a short video call with IT or security from their phone, through a meeting link sent to their personal email. That link is safe to send, because it opens a meeting and nothing else.

On the call, compare their face to a government ID whose security features you've checked, and run the address check from the last section. Ask a question or two about the work they interviewed for. If you hire at volume, a document verification tool with a liveness check can run the ID comparison before the call and shorten it to the steps below.

Then give them the one-time code and have them type it on the managed laptop in view of the camera. Watch the device record as they do, because the sign-in should arrive from that laptop's serial number at that moment, tying the person on the call to the hardware. Stay on the call while they register a phishing-resistant authenticator, such as a passkey or security key.

If the call can't happen on the first morning, because of a broken camera, a bad connection, or a start time in the middle of IT's night, move the start instead of opening sign-in without it. When the business can't wait, write a dated exception with an end date, limit access to collaboration tools, and run the full check within the first few days.

Drop the habit of emailing a temporary password to the personal address on the application. It hands the account to whoever controls that inbox. The same goes for any workflow that turns sign-in on when the offer is accepted, before anyone has seen the person.

Tell new hires ahead of time if you record the call, get their consent, and set a retention period for the recording. Keep HR's Form I-9 steps separate, since employment eligibility verification follows its own rules, and check with counsel before reusing anything collected for it.

The same call that confirms the person also gets them working. When it ends, they're signed in on a managed laptop with a passkey registered and their day-one apps already waiting.

Limit day-one access with birthright sets and time-bound grants

No check gets the odds of a fraudulent hire to zero, and day-one access decides what one can reach when every earlier step in the employee onboarding process misses. KnowBe4, the security awareness company, met the same kind of scheme as the Arizona case in July 2024. It hired a principal software engineer for its internal IT AI team after four video interviews, a clear background check, and verified references. The hire was using a stolen U.S. identity and an AI-enhanced stock photo.

The new Mac started loading malware as soon as it arrived. KnowBe4's security team got the first alert that night and contained the laptop about 25 minutes later, and the company says no illegal access was gained. The hire had also started in the highly restricted area where KnowBe4 puts new employees, with no access to production.

Birthright access is the set everyone in a role gets automatically. Build it from a written access profile for each role, and keep it to collaboration tools and the core apps the job needs. With automated HR onboarding applying it from the HR record, online onboarding has all of it waiting at the first sign-in.

Production, customer data, admin consoles, and payment approvals stay out of birthright and arrive by request, for a set window. For the first 30 days, add a second approver to those requests, since the manager has known the hire for only a few weeks. A new engineer on call in their first month still gets production for the shift, with security signing off alongside the manager.

At GitLab, Lumos helped the security team remove admin access nobody needed and move critical entitlements to just-in-time access across more than 2,000 employees. Erik Lentz, Senior Manager, Security Engineering, describes the goal as structure and control around access, so his team can get out of the way.

Time-bound grants work best when they close on their own. Time-bound access in Lumos is granted just in time and removes itself when the window ends, and Albus, its AI agent, suggests the shortest window that fits each request. Albus also checks each request against your Segregation of Duties (SoD) policy, the rules for which permissions one person shouldn't hold together, and flags a conflicting combination before it's granted.

List what your last new engineer could reach on day one, and mark everything they didn't touch in the first two weeks. That marked list is the first cut to your birthright set.

Onboarding remote employees with self-service access requests

Much of a new hire's first week at an office runs on quick questions at the next desk. For a remote hire, each of those questions becomes a ticket, a stalled task, or a borrowed login unless there's a faster way to ask. The fix is a catalog in the chat tool they already use, where routine apps clear on their own and the rest go to a person.

Design that request path as carefully as the welcome email. Keeping it in chat means nobody has to remember a portal. Route anything outside the routine to the manager and then the app owner, with enough context to decide in minutes. That routing is also the first thing to test in any employee onboarding software demo.

Routine requests can clear before anyone finishes asking. In Lumos AppStore, people request access from the catalog, Slack, Teams, a CLI, or an ITSM tool. When a request matches what the requester's peers already hold, Albus can approve it on the spot and log why, inside the scoped permissions and policy you define.

Write that policy for routine apps only. Production, customer data, admin consoles, and payment approvals stay on the approval path from the last section, however many peers hold them. Give the approver the requester's role, peer group, and past decisions on similar requests.

Pinterest uses Lumos as its de facto software inventory for more than 8,000 employees, and new employees go there to find the apps their roles need. For a remote hire, that catalog is the coworker who used to point at the screen.

A request that waits a day teaches someone new to borrow a teammate's login. That borrowed access never shows up in a review, and it's still there when the new hire leaves.

Close the online onboarding process with a 90-day access review

A welcome survey tells you how the first month felt to the new hire, and it's worth sending. It can't tell you which grants got extended or which apps the person never needed. A review of what they can reach catches first-month exceptions before they harden into standing access.

Prosper brought compliance for all its apps into one place on Lumos and completed access reviews in record time. Once reviews run that quickly, you can review everyone who reached day 90 that month in one small batch instead of waiting for the next quarterly cycle.

That review looks for five signals. Grants the person never touched mean birthright is too broad, and time-bound grants renewed more than once have turned into standing access. Access outside what the role's peers hold, approvals from someone other than the current manager, and sign-ins from unmanaged devices or far from where the laptop went each need an answer before they become normal.

The reviewer should see what the hire used and what sat idle. Lumos user access review software brings each person's usage patterns, prior decisions, and known exceptions into the review, and it flags changes, anomalies, SoD conflicts, and privileged access. It revokes rejected access automatically and keeps each decision as audit evidence.

Pick everyone who started 90 days ago and run the review on their access this month. The number of grants nobody would approve again is your baseline for the next group of hires.

Make identity the first step of online employee onboarding

The building used to confirm who your new hires were for free. Online onboarding has to do it on purpose, and the first sign-in is the one moment when the person, the laptop, and the account are all in front of you.

Two numbers tell you whether the program works. Count the accounts that worked before a live check and compare the total with your dated exceptions. Then track how many access requests each new hire needs a person to approve in week one.

This month, put the six checks on your employee onboarding checklist with a name beside each, add a live check before any account goes live, and enroll every new laptop before it ships. This quarter, cut day-one access back to what new hires use, move requests into chat, and run your first day-90 review. Onboarding goes right when the first sign-in proves who someone is, not just that someone has the code.

Your next remote hire may never walk into one of your offices. Book a demo to walk through that hire's first week in Lumos, from the accounts and birthright that Lifecycle Management has ready on the start date to elevated access that closes on its own. You'll also see routine requests clear in Slack or Teams and a day-90 review that shows what the hire used.

‍