Everyday office basics
Your first day with a work laptop: what to set up
A calm, ordered walkthrough of the genuinely useful first hour with a new work laptop: signing in, setting up multi-factor on your phone, finding email, calendar and chat, getting on the Wi-Fi, and learning the lock shortcut.
Ask where things are on day one. It is expected, and it is always faster than hunting.
Last reviewed 2026-08-18 by Grayson Dodson. Free, plain-English guidance for everyday work technology.
What you'll be able to do
after this you will be able to sign in to a new work laptop, set up multi-factor on your phone, find email, calendar and chat, get connected to the office Wi-Fi or VPN, and lock your screen when you step away, without anyone needing to hover over you
signing in for the first timethe setup and enrollment screensmulti-factor authentication (mfa)microsoft authenticator, duo, and okta verifyfinding email, calendar, and chatoffice wi-fi and vpnlocking your screen and signing outsaving files where they back up
What the enrollment screens are actually doing
Somewhere in your first hour a screen will announce that it is setting up your device, and it will sit there long enough to worry you. It is fine. A managed laptop is one your employer's device-management system controls, and enrollment is the handshake that ties this particular machine to your work account. On Windows that runs through Settings, then Accounts, then Access work or school, or through the Company Portal app from the Microsoft Store, where you sign in and choose Next, then Connect. On a Mac it is the same Company Portal app: choose Download profile, then open System Settings, Privacy and Security, Profiles, and choose Install, then Enroll, until a green checkmark appears. Macs run by Jamf instead show an app called Self Service, or Self Service+, which some companies rename to something like Software Center. What all this buys is the ability to push settings, install the software your role needs, require a PIN or a fingerprint, and erase the laptop remotely if it is stolen. Expect twenty minutes and a restart or two. If you want the ground-level basics underneath all this, the gentler walkthrough of getting comfortable with a work computer covers them.
Setting up multi-factor, step by step
You will be asked to set up multi-factor authentication, usually shortened to MFA, and this is the one worth doing slowly. On Microsoft 365, go to aka.ms/mfasetup, which lands you on the security info page at mysignins.microsoft.com/security-info. Choose Add sign-in method, pick Microsoft Authenticator, and scan the square QR code with the free app on your phone. After that, signing in puts a two-digit number on your laptop screen that you type into the app rather than just tapping Approve. Microsoft made that number matching the standard so that nobody approves a prompt by reflex. Duo works much the same way: you scan a QR code once when you enroll, then afterward you either tap Approve or type a short code from your screen into Duo Mobile and tap Verify. Add a second method while you are already there, a phone number or a set of recovery codes, so a dead battery never strands you. If an approval prompt appears when you were not signing in, deny it, report it if the app offers to, and tell your IT service desk. Its address, portal link, or phone number is in your onboarding email. Save it in your phone now.
Wi-Fi, the VPN, and getting on the network
Offices usually broadcast at least two Wi-Fi networks, a guest one and a staff one, and you want the staff one. It often asks for your work email and password instead of a shared Wi-Fi password, which looks strange the first time and is completely ordinary on a corporate network. On Windows the list sits behind the Wi-Fi icon at the bottom right, near the clock; on a Mac it is the same icon at the top right. If two names look equally plausible, ask instead of guessing. Working from home may add a VPN, a private tunnel back to the company network so internal systems recognize you. The clients you are most likely to meet are Cisco Secure Client, which was called AnyConnect until version five, Palo Alto's GlobalProtect, FortiClient, Zscaler Client Connector, and Cloudflare WARP. Look for a small icon near the clock and choose Connect, or on Windows open Settings, then Network and internet, then VPN. Some of these connect themselves the moment you sign in and never ask you anything at all. Plenty of companies have moved to setups that need no VPN, so ask outright whether you need one and which systems require it.
Where to save files so they survive
The desktop is a trap on a work laptop. Anything left on the Desktop or in Downloads exists on that one machine, so it travels wherever the machine goes and nobody else can open it. On Microsoft 365, keep your own drafts in OneDrive and anything the team touches in SharePoint or in a Teams channel, where the tab holding a channel's files is now called Shared rather than Files. In Word or Excel that is File, then Save As, then OneDrive or the site you want. You can also let Windows handle it: open OneDrive settings from the cloud icon near the clock, go to the Backup tab, choose Manage backup, and switch on Desktop, Documents, and Pictures. In File Explorer a small cloud or green check beside a filename means it is backed up. Google Workspace works the same way under different names. My Drive is yours alone, while a shared drive belongs to the team, so files put there stay put when people join or leave. Ask which SharePoint site or shared drive your team genuinely uses. Everyone has an opinion, and asking on day one saves a week of quiet confusion later.
The first-week habits that actually matter
Lock your screen every time you stand up, which is the Windows key and L together, or Control and Command and Q on a Mac. Beyond that, a handful of first-week habits pay for themselves. Save your IT service desk details somewhere you can reach without your laptop, because the day you need them is the day you cannot sign in. Test your multi-factor backup method now rather than discovering it does not work while you are standing in an airport. Ask to be added to things instead of waiting: the Teams or Slack channels your team actually lives in, the shared drive, the mailing lists, and any system you will need in week two, since access requests often take days to clear. Find out how password resets work where you are, whether that is a self-service page or a call. And keep a note on your phone of what each unfamiliar app is for, written down as someone explains it. In three weeks you will have forgotten, and you will be glad you do not have to ask a second time.
Personal use, and the sentences that get you help
One honest note before the good part. A work laptop belongs to your employer, and a managed one can be configured to report far more than your own devices do: the sites you visit, the software you install, and the contents of your work email and files. That is how device management works rather than anything sinister, and there is a separate lesson here answering whether your employer can see what you do on your work laptop, so you never have to guess about it. The day-one version is simply this: keep personal banking, private messages, and job hunting on your own phone and your own connection. Now the part that matters most. Asking where something is is normal, expected, and far faster than hunting for it alone. Borrow these word for word if it helps. To a colleague: I started this week, could you show me where the team saves files? Or: quick one, which Wi-Fi should I be on? To the service desk: New starter, first day, laptop enrolled fine. I cannot sign in to the finance system. Could you check my access? Say you are new. It gets you a kinder, better answer.
Common questions
What should I set up first on a new managed work laptop?
Let the enrollment screens finish, even if the laptop restarts itself once or twice, then set up multi-factor on your phone and add a backup method straight away. After that, connect to the staff Wi-Fi, start the VPN client if your team uses one, and find out where your files are meant to live, whether that is OneDrive and SharePoint or Google Drive and a shared drive. Finally, save your IT service desk address somewhere that is not the laptop. An hour spent this way makes the whole week calmer.
Do I have to install Microsoft Authenticator or Duo on my personal phone?
Usually yes, though it is fair to ask for another option. Authenticator, Duo Mobile, and Okta Verify only handle sign-in approvals; they cannot read your photos or your messages. If you would rather not use your own phone, ask IT whether they can issue a hardware security key such as a YubiKey, turn on phone-call or text message codes, or provide a work phone. Service desks are asked this often, so ask plainly rather than quietly skipping the step and getting locked out a month later.
Can my employer see what I do on my work laptop?
Generally yes, and more than most people expect: on a managed laptop your employer can typically see the sites you visit, the software you install, and everything held in your work email and files. What is actually switched on varies enormously between companies and between countries, so the honest answer needs more room than a FAQ. There is a full lesson here on whether your employer can see what you do on your work laptop, covering what is usually logged, what almost never happens, and how to check your own machine.
What is the Company Portal or Jamf Self Service app doing to my laptop?
It enrolls the laptop in your employer's device-management system, which is how the machine receives its settings, its security rules, and its approved software. In practice that means IT can push updates, require a PIN or a fingerprint, install the apps your role needs, and erase the device remotely if it is lost or stolen. Both apps also work as an internal app store, so if you need something like Zoom or a VPN client, look there before filing a ticket. It is often already approved and one click away.
Where should I save files so my team can find them?
Not the Desktop or Downloads, which exist only on that one laptop. On Microsoft 365, put personal drafts in OneDrive and shared work in SharePoint or a Teams channel, where the files now sit under the tab called Shared. You can also open OneDrive settings, go to the Backup tab, choose Manage backup, and switch on Desktop, Documents, and Pictures so those folders sync by themselves. On Google Workspace, use a shared drive rather than My Drive for team files, so they stay put when people come and go.