Every time a new employee joins a UAE business, IT has a decision to make: spend 4–6 hours manually imaging a laptop, creating accounts, and configuring VPN clients — or automate the entire process so the device is business-ready before it arrives at the employee's desk. For Dubai companies growing past 30 seats, manual IT onboarding is no longer a sustainable model. Configuration errors accumulate, security baselines drift, and IT engineers spend their time on repeatable tasks instead of infrastructure projects. NOCKO implements a fully automated IT onboarding and offboarding lifecycle using Microsoft Windows Autopilot, Microsoft Intune (Endpoint Manager), and Azure Active Directory / Entra ID — reducing device provisioning time from hours to under 30 minutes, with no hands-on IT involvement required per device.
Zero-Touch Device Provisioning with Windows Autopilot
Traditional laptop deployment in Dubai IT departments relied on maintaining "Golden Image" USB drives — a monolithic snapshot of Windows plus corporate software that was cloned onto every new machine. This model breaks down quickly: the image requires constant updates for every Windows patch and software version change, different hardware models from Dell, Lenovo, and HP require separate images, and the process ties an IT engineer to a desk for hours per device. For remote hires or branch offices in Abu Dhabi, Sharjah, or other emirates, the model fails entirely.
Windows Autopilot replaces this with a cloud-driven, zero-touch provisioning workflow. Before hardware arrives at the employee's location, your certified hardware distributor registers the device's unique hardware hash directly into your Microsoft tenant. The device is enrolled in your Autopilot deployment profile before anyone opens the box. When the employee powers it on and connects to any internet connection — home Wi-Fi, hotel, or office — Windows contacts Microsoft, recognises the device belongs to your organisation, and replaces the default Windows setup experience with your corporate branded login screen. No USB drives. No IT engineer present. No manual imaging.
Upon authentication with the employee's Microsoft 365 credentials, Intune automatically pushes the full configuration: security baselines, BitLocker disk encryption, conditional access policies, required applications (Microsoft 365 Apps, corporate VPN client, EDR agent), and mapped SharePoint drives. The entire process completes in the background while the employee begins their first day. From a business continuity perspective, this also means a replacement device can be shipped to an employee whose laptop fails and be fully operational within the same day — without IT touching it.
Microsoft 365 and Entra ID Account Setup
Device provisioning is only one half of IT onboarding. Account setup across Microsoft 365 and Azure Active Directory / Entra ID must be equally systematic. Ad-hoc account creation — where IT manually creates mailboxes, assigns licences, and adds users to distribution groups on request — produces inconsistency: some users end up with the wrong licence tier, critical security groups are missed, and there is no audit trail for who has access to what.
NOCKO structures your Entra ID around role-based access control (RBAC) with dynamic group membership. When a new user account is created with the correct department and job title attributes, Entra ID automatically assigns them to the appropriate security groups, Microsoft 365 licence (Business Premium, E3, or E5 depending on role), shared mailboxes, Teams channels, and SharePoint site access. No manual group additions are required because the rules are defined at the directory level, not applied case by case.
- Licence assignment: Dynamic group rules assign the correct Microsoft 365 licence tier based on department attribute — Business Premium for standard users, E3 for power users requiring Visio or Project, E5 for compliance or security-sensitive roles.
- Multi-Factor Authentication enforcement: Conditional access policies require MFA for all users from day one, with no exceptions. Risky sign-in policies flag anomalous logins (impossible travel, unfamiliar device) and force step-up authentication automatically.
- Privileged Identity Management (PIM): For users who require temporary admin rights — an IT contractor needing Global Admin for a migration task — PIM issues time-bounded elevation with full audit logging, eliminating standing admin accounts.
- Shared resource access: Distribution lists, shared mailboxes, Teams channels, and SharePoint document libraries are provisioned automatically based on department membership, with access reviews scheduled quarterly via Entra ID Access Reviews.
MDM Enrollment and Endpoint Security Baseline
Every device enrolled through Autopilot is simultaneously enrolled in Microsoft Intune MDM from first boot. This is not optional for UAE enterprises that handle sensitive client data, financial records, or regulated information — it is the foundational control that makes every subsequent security policy enforceable. An unmanaged device on your network is a blind spot; an Intune-managed device is a documented, auditable endpoint with a known security posture.
NOCKO configures your Intune environment with security baselines derived from the Microsoft Security Baseline (aligned with CIS Controls Level 2) and hardened further based on your industry requirements. For DIFC-licensed financial services firms, baselines are mapped against DFSA IT Risk Management guidelines. For healthcare organisations, they align with DOH and MOHAP data handling requirements.
- BitLocker encryption: Full-disk encryption is enforced at enrolment with recovery keys escrowed to Entra ID — not stored on a spreadsheet or in a shared email folder. If a device is lost or stolen in transit, the data is unreadable without the corporate key.
- Windows Defender and EDR configuration: Intune deploys and locks Windows Defender configuration, including tamper protection, cloud-delivered protection, and attack surface reduction rules. For higher-risk environments, we integrate Microsoft Defender for Endpoint as the EDR layer with SIEM forwarding.
- Conditional access policies: Compliant device requirement — enforced via Intune compliance policies — is a prerequisite for accessing Microsoft 365, Azure, and any cloud application registered in Entra ID. A device with an outdated OS patch level or disabled encryption automatically loses access until remediated.
- Application deployment: Required applications are deployed silently via Intune. Optional applications are published to the Company Portal for self-service installation. Either way, no local admin rights are required — users cannot install unapproved software, which eliminates a significant malware attack vector.
- Mobile device management: iOS and Android devices used for corporate email or Teams are enrolled via Intune App Protection Policies (MAM), separating corporate data from personal data without requiring full device management on personal phones — a critical distinction for BYOD policies common in Dubai SMEs.
Offboarding: Security Procedures and Licence Reclamation
IT offboarding is consistently the most under-engineered part of the user lifecycle in UAE businesses. When an employee leaves — whether voluntarily, through redundancy, or in a disciplinary situation — the window between HR notification and IT account deactivation is a direct security risk. Former employees with active credentials and device access represent one of the most common sources of insider data exfiltration and credential-based breaches.
NOCKO implements a structured offboarding runbook that executes systematically and leaves a full audit trail. The process is triggered by an HR notification or manager request and proceeds through a defined sequence regardless of the circumstances of the departure. For sensitive departures, IT can be notified confidentially and accounts disabled before the employee is informed — a capability that requires a mature identity management architecture to execute cleanly.
- Account disabling sequence: Entra ID account is disabled immediately upon offboarding trigger, which simultaneously revokes all active Microsoft 365 sessions, blocks Exchange mailbox access, invalidates all OAuth tokens, and removes the user from all dynamic group memberships. A single action cascades across the entire M365 ecosystem.
- Mailbox and data retention: Rather than deleted, the mailbox is converted to a shared mailbox or placed on Litigation Hold for a configurable retention period (30, 90, or 365 days depending on policy and UAE regulatory requirements). This preserves business-critical emails and satisfies e-discovery requirements for regulated industries without occupying a paid licence seat.
- Licence reclamation: Microsoft 365, Defender for Endpoint, and any other per-user licence assignments are removed and returned to the licence pool immediately. For companies with 50+ users, unreclaimed licences from departed staff frequently account for AED 15,000–40,000 in annual wasted spend — a figure NOCKO surfaces clearly during quarterly licence audits.
- Device management — remote wipe or Autopilot Reset: If the device is being returned, an Intune Remote Wipe command is issued from the portal, erasing all corporate data and resetting Windows to factory state. If the device will be reallocated, an Autopilot Reset re-provisions it for the next employee without requiring any physical IT work. If the employee is remote and the device is not returned, the device remains locked out of all corporate resources via conditional access — it becomes inert to corporate data regardless of what the former employee attempts.
- Access audit: Post-offboarding, NOCKO runs an Entra ID access review confirming no residual permissions, shared mailbox delegations, or guest account access remains active. For admin accounts, we confirm the account is fully removed from all privileged directory roles, not merely disabled.
Onboarding and Offboarding Process Summary
The complete IT onboarding and offboarding lifecycle, when properly automated, requires minimal IT labour per employee. For Dubai businesses processing 5–20 hires or departures per month, the time saving over manual processes is substantial — typically 3–5 hours of IT engineer time per employee event, which compounds significantly at scale. Beyond time savings, the consistency and security controls delivered by the automated process are qualitatively superior to any manual equivalent.
NOCKO's implementation engagement covers Autopilot profile configuration, Intune baseline deployment, Entra ID dynamic group architecture, conditional access policy design, and offboarding runbook documentation. For businesses already using Microsoft 365 without these controls in place, the implementation typically takes 10–15 business days depending on existing tenant complexity and the number of role archetypes requiring custom group structures.
- Onboarding timeline: New hire IT setup reduced from 4–6 hours of manual IT work to under 30 minutes of automated provisioning. Device ships directly from distributor to employee; account is ready before hardware arrives.
- Offboarding timeline: Full account deactivation, session revocation, and licence reclamation completed within 15 minutes of an authorised offboarding request. No manual checklist. No items missed. Full audit log retained.
- Compliance posture: Every device enrolled, every account change logged, every access removal documented in Entra ID audit logs — providing the evidence trail required for ISO 27001, SOC 2, NESA, and DFSA IT governance frameworks.
- Hardware lifecycle: Autopilot Reset extends device lifespan by eliminating the need to reimage hardware between users. Devices are returned to business-ready state programmatically, without IT touching a keyboard.
Frequently Asked Questions
- How long does automated IT onboarding take for a new employee in Dubai?
- With Windows Autopilot and Microsoft Intune configured, device provisioning takes under 30 minutes from first power-on — with no IT engineer present. Account setup via Entra ID dynamic groups and conditional access policy assignment is instantaneous upon account creation. The total elapsed time from hire confirmation to a fully configured, secure, business-ready device is typically same-day or next-day, depending on hardware shipping logistics. For remote employees across the GCC, the hardware ships directly from the distributor to the employee's location and self-provisions on first boot without any IT involvement.
- What happens to Microsoft 365 data and emails when an employee leaves?
- NOCKO's offboarding runbook converts the departing employee's mailbox to a shared mailbox or places it on Litigation Hold before the account is disabled — preserving all email, calendar data, and OneDrive files for a configurable retention period. This satisfies both business continuity requirements (managers retaining access to critical correspondence) and regulatory requirements for industries subject to DFSA, UAE Central Bank, or ADGM data retention obligations. Separately, SharePoint and Teams content created by the departing employee remains in place under the owning site/team — it is not deleted with the user account. The licence assigned to the account is reclaimed immediately, so data retention does not incur ongoing per-user licence cost.
- Does NOCKO's IT onboarding solution work for BYOD policies and mobile devices?
- Yes. For personally-owned devices (BYOD), NOCKO implements Microsoft Intune App Protection Policies (MAM without MDM enrolment). This configuration applies corporate security policies — PIN enforcement, copy/paste restrictions between corporate and personal apps, remote corporate data wipe — exclusively to the Microsoft 365 applications on the device, without enrolling or managing the personal device itself. Corporate email, Teams, and SharePoint data are sandboxed from personal apps. On offboarding, IT can issue a selective corporate data wipe that removes all corporate application data from the personal device without affecting personal photos, contacts, or apps. This is the correct model for Dubai SMEs with mixed corporate-owned and employee-owned device environments.