--- title: "How to Give a Virtual Assistant Access to Accounts Safely" description: "Give a virtual assistant access to email, files and tools safely: sign an NDA, grant least access, use delegate features, turn on MFA, and offboard cleanly." url: https://peachtreeva.multisites.ai/guides/give-a-virtual-assistant-access-safely publisher: Peachtree VA book: https://peachtreeva.multisites.ai/contact --- # How to Give a Virtual Assistant Access to Your Accounts Safely Peachtree VAUpdated October 29, 20268 min read The short answer Give a virtual assistant access safely in five moves. Sign an NDA first. Grant only the access the job needs. Use each tool's delegate or sharing feature instead of your password. Require a password manager and multifactor authentication. When the work ends, remove access using a written offboarding checklist. ## NDA and vetting first Sign a non-disclosure agreement and confirm background checks before you share anything. ## Least access Give only the access the task needs, and review it every month. ## Delegate, do not share logins Gmail and Outlook have delegate features that keep your password private. ## Remove access on exit Use a written checklist to remove every login, share and token. Access plan: what to grant, how, and what to avoid Tool Safer way to grant Avoid Review Email Delegate access (Gmail or Outlook) Sharing your password Monthly Calendar Edit or delegate permission Full account access Monthly Files Share specific folders Whole-drive access Monthly Business software Named user with limited role Admin account Quarterly Passwords Password manager shared items Passwords in email or chat Quarterly Bank and payments None, or view-only through your bookkeeper Login credentials Every change General best practice from CISA, FTC, Google and Microsoft help pages. Not legal or IT advice for your case. ## Is it safe to give a virtual assistant access to your accounts? It is safe when you manage it. Sign a non-disclosure agreement, grant only the access the job needs, use each tool’s delegate or sharing feature instead of your password, turn on multifactor authentication and remove access when the work ends. Most problems come from shortcuts, not from the assistant. This guide gives general best practice from official sources: CISA, the FTC, Google and Microsoft. It is not legal or IT advice for your case. Your IT provider or attorney can tailor it. On the Peachtree VA side, we state two facts. Every Peachtree VA clears multi-stage interviews, a skills assessment and background checks, and signs an NDA before meeting a client. We do not claim specific security tools. The access rules for your own accounts are yours to set, and this guide shows how. A [virtual assistant](https://peachtreeva.multisites.ai/glossary/virtual-assistant) often needs to see email, calendars and files. The goal is not zero access. The goal is the right access, for the right time, with a way to take it back. ## Why start with an NDA and vetting? An NDA sets a legal duty to keep your business information private, and vetting lowers the chance you hand access to the wrong person. Do both before you share any login or file. They do not replace technical controls, but they set the base of trust. A [non-disclosure agreement](https://peachtreeva.multisites.ai/glossary/non-disclosure-agreement) is a signed contract that requires a person to keep business information private. Check these points: 1. The NDA is signed before access is shared. 2. It covers client data, financials and any private files. 3. It states what happens to your files when the work ends. 4. Your assistant has passed a background check and reference checks. If you hire a freelancer, ask for the NDA and run the checks yourself. If you use a managed provider, ask what is already done. At Peachtree VA, the NDA and background checks come before any client meeting. See [how to hire a virtual assistant](https://peachtreeva.multisites.ai/guides/how-to-hire-a-virtual-assistant) for the full vetting list. ## What does least access mean for a virtual assistant? Least access means giving a person only the access their tasks need. Start with the smallest set, then add more when a task requires it. The FTC puts it this way: “Administrative access, which lets a user make system-wide changes to your system, should be limited to the employees tasked with that job.” That advice applies to contractors too. In practice: - **Map tasks to access.** Email triage needs mailbox access, not your bank login. - **Avoid admin rights.** Give a standard user role, not an owner or admin role. - **Share folders, not drives.** Give access to the folders a task uses. - **Set an end date.** Note when each access should be reviewed or removed. - **Review monthly.** Remove what you no longer use. Use the table at the top of this page as a starting plan. Fill it in for your own tools. Then store the plan where you can find it later, because you will need it at offboarding. Your [SOPs](https://peachtreeva.multisites.ai/guides/virtual-assistant-sops) should name the tools and access each task needs, but never include passwords. ## Should you share logins or use delegate access? Use delegate access whenever the tool offers it. Delegate access lets your assistant work in your account without knowing your password, and you can remove it in seconds. Shared logins hide who did what, break when you change a password and are harder to take back. Google defines the Gmail version in plain terms: “A delegate is someone who can read, send, and delete emails in your account for you.” Google also notes that a delegate “can’t chat with anyone or change your password.” That limit is the point. Your password stays with you. Microsoft’s Outlook works the same way. Its help page says “you determine the level of access that the delegate has to your calendar or mail folders.” You choose read-only or read, create, change and delete. Note that Microsoft says delegate access is only available with a work or school account in Microsoft 365 or Exchange Online. Approach Strength Risk Delegate access Your password stays private. Easy to remove Not offered by every tool Named user seat Each person has an own login and an activity trail May cost a seat fee Shared password in a password manager Better than email or chat The password still exists in more places Password sent in email or chat None Easy to copy, forward and leak If a tool has no delegate feature, create a named user with a limited role. If that is not possible, share through a password manager and change the password at offboarding. ## How do passwords and multifactor authentication fit in? Use a password manager and turn on multifactor authentication for every account that supports it. A password manager stores long, unique passwords. MFA adds a second check at sign-in. Together they block most simple account takeovers, and they protect the access you give your VA. CISA recommends both. On passwords: “A company-wide password manager makes it easier for employees to follow best practices.” On MFA: “Multifactor authentication (MFA) adds an extra layer of protection by requiring two or more ways to verify a user’s identity.” CISA adds that “Businesses should aim to use a phishing-resistant MFA method.” Set these rules for yourself and your assistant: 1. Use a password manager. Never send passwords by email or chat. 2. Use long, unique passwords for each account. 3. Turn on MFA for email, banking, payroll and business software. 4. Prefer phishing-resistant MFA where available. 5. Keep recovery codes with you, not with the assistant. For finance, be stricter. Your VA does not need your bank login to chase invoices or collect receipts. If you want help with the books, use a bookkeeper with limited, named access. Peachtree VA bookkeeping works alongside your CPA. Read about [outsourced bookkeeping](https://peachtreeva.multisites.ai/glossary/outsourced-bookkeeping). ## What if a tool has no delegate feature? Create a named user with a limited role if the tool allows it. If it does not, share through your password manager, limit what the account can do, and plan to change the password at offboarding. Treat this as a fallback and note it in your access list. Work through these options in order: 1. **Named user seat.** Your assistant gets a login with the lowest role that fits the task. 2. **Shared item in a password manager.** The assistant can sign in without seeing the password, if your tool supports that. 3. **Shared account with a dedicated email.** Use an address you control, such as a role-based mailbox, so the account does not depend on one person. 4. **Task performed with you.** For rare, high-risk actions, do a short screen share and click the final button yourself. Never move money on the strength of an email or chat message alone. Set a rule that any new payment instruction gets confirmed by a second method, such as a call to a known number. This one habit stops a common kind of fraud and takes a minute. ## What are the warning signs that access is too wide? Access is too wide when your assistant holds rights that no current task needs. Look for admin roles, shared passwords, old logins and tools nobody uses. A short monthly review finds these quickly. Fixing one early costs a minute. Finding one late can cost much more. Check for these signs: - Your assistant is an owner or admin in a tool where a standard user would do. - More than one person knows the same password. - Access was granted for a project that has ended. - You cannot list every tool your assistant can reach. - Recovery email or phone numbers point to someone else. If you see any of them, narrow the access now, then update the list. Treat your assistant’s questions as a signal too. If they ask for new access, ask what task needs it and add it with a note. Good assistants expect these questions, and they respect an owner who runs a careful process. ## What should you do during onboarding? Grant access in steps during the first weeks and write down every grant. Start with email and calendar delegate access, add the shared folders for the first three tasks, then add tools as the work needs them. This ties access to proven need and keeps a clear record. Add these items to your [onboarding](https://peachtreeva.multisites.ai/glossary/onboarding) plan: 1. Sign the NDA. 2. Create the access list with tool, level, date and reason. 3. Grant delegate access for email and calendar. 4. Share only the folders the first tasks use. 5. Set up the password manager and MFA. 6. Review the access list at day 30. Our guide to [how to onboard a virtual assistant](https://peachtreeva.multisites.ai/guides/how-to-onboard-a-virtual-assistant) has the full 30-day plan. ## What is on a good offboarding checklist? A good offboarding checklist removes every login, share and token the same day the work ends, then confirms each one. Write it at the start, not at the end. Without a list, access tends to outlive the relationship, and old access is a quiet risk. [Offboarding](https://peachtreeva.multisites.ai/glossary/offboarding) covers removing access and handing off work. Use this list: Step Done Remove delegate access to email and calendar Remove folder shares and shared drive access Remove user seats in business software Remove items shared in the password manager Change any password the VA knew Revoke connected apps and tokens Collect files, SOPs and notes Confirm in writing that data is returned or deleted Review recent account activity for anything odd The FTC says that if vendors and contractors do not need consumers’ sensitive personal information for their services, “there’s no reason for them to have access to it.” Offboarding is the other end of that rule: when the need ends, the access ends. If the end of a working relationship is a poor fit rather than a project end, Peachtree VA’s 100% Matching Guarantee means we [rematch](https://peachtreeva.multisites.ai/glossary/rematch) you at no extra cost. Run the offboarding checklist for the old assistant, then the onboarding list for the new one. ## Next step Want help setting up a safe, clear process from day one? Learn about our [virtual assistant services](https://peachtreeva.multisites.ai/va-services) or [book a free strategy call](https://peachtreeva.multisites.ai/contact). ## Frequently asked questions ### Is it safe to give a virtual assistant access to my email? It can be safe if you use the delegate feature, not your password. Gmail says a delegate can read, send and delete emails for you but cannot chat or change your password. Use a signed NDA, turn on MFA and review access monthly. ### Should I share my passwords with my virtual assistant? No. Share access through each tool's delegate or sharing feature, or through a password manager that hides the password. CISA advises a company-wide password manager so staff can follow best practices without passing passwords around. ### What is least privilege access? It means giving a person only the access their tasks need, and nothing more. The FTC advises limiting administrative access to the people tasked with that job. For a VA, start with the minimum and add access as trust and need grow. ### What does Peachtree VA do to protect client information? Every Peachtree VA clears multi-stage interviews, a skills assessment and background checks, and signs an NDA before meeting a client. We do not claim specific security tools. You still set access rules for your own accounts. ### Should my virtual assistant use multifactor authentication? Yes, on every account that supports it. CISA says MFA adds an extra layer of protection by requiring two or more ways to verify a user's identity. Prefer phishing-resistant methods where your tools offer them. ### How do I remove access when the work ends? Use a written offboarding checklist: remove delegate access, folder shares, user seats and password manager items, change shared passwords, and revoke connected apps. Do it the same day the work ends, then confirm each item. ## Terms in this article - [Non-disclosure agreement (NDA)](https://peachtreeva.multisites.ai/glossary/non-disclosure-agreement) - [Outsourced bookkeeping](https://peachtreeva.multisites.ai/glossary/outsourced-bookkeeping) - [Matching guarantee](https://peachtreeva.multisites.ai/glossary/matching-guarantee) - [Virtual assistant](https://peachtreeva.multisites.ai/glossary/virtual-assistant) - [Offboarding](https://peachtreeva.multisites.ai/glossary/offboarding) - [Onboarding](https://peachtreeva.multisites.ai/glossary/onboarding) - [Rematch](https://peachtreeva.multisites.ai/glossary/rematch) ## Sources 1. [Google: Delegate & collaborate on email (Gmail Help)](https://support.google.com/mail/answer/138350?hl=en) 2. [Google: Delegate & collaborate on email, limits (Gmail Help)](https://support.google.com/mail/answer/138350?hl=en) 3. [Microsoft: About delegates in Outlook](https://support.microsoft.com/en-us/outlook/sharing/about-delegates-allow-someone-to-manage-your-mail-and-calendar-in-outlook) 4. [CISA: Require Multifactor Authentication](https://www.cisa.gov/audiences/small-and-medium-businesses/secure-your-business/require-multifactor-authentication) 5. [CISA: Require Multifactor Authentication, method](https://www.cisa.gov/audiences/small-and-medium-businesses/secure-your-business/require-multifactor-authentication) 6. [CISA: Require Strong Passwords](https://www.cisa.gov/audiences/small-and-medium-businesses/secure-your-business/require-strong-passwords) 7. [FTC: Start with Security, a guide for business](https://www.ftc.gov/business-guidance/resources/start-security-guide-business) 8. [FTC: Start with Security, vendors and contractors](https://www.ftc.gov/business-guidance/resources/start-security-guide-business) ## Keep reading - [### How to Onboard a Virtual Assistant in 30 Days Onboard a virtual assistant in four weeks. Prepare goals and access before day one. Week one covers context and tools. Week two uses supervised tasks. Week three moves to independent work. Week four is a review. Use one weekly check-in and written feedback throughout, then decide whether to add hours. Read](https://peachtreeva.multisites.ai/guides/how-to-onboard-a-virtual-assistant) - [### How to Hire a Virtual Assistant: A Step-by-Step Guide To hire a virtual assistant, audit your week, pick a model (freelancer, agency or managed provider), set monthly hours, vet for skills and fit, and onboard over 30 days. Review the results monthly. Most owners need 10 to 40 hours a week of support at first and can add hours later. Read](https://peachtreeva.multisites.ai/guides/how-to-hire-a-virtual-assistant) - [### How to Write SOPs a Virtual Assistant Can Run An SOP for a virtual assistant is a short, written, step-by-step guide to one task, with the goal, tools, steps, examples and a check for done. Start with tasks that repeat weekly. Use the template in this guide, add a screen recording, and review each SOP every quarter. Read](https://peachtreeva.multisites.ai/guides/virtual-assistant-sops) ## Get your week back. Book a free, no-obligation strategy call. We will map out what to hand off first, and you leave with a plan whether or not you become a client. [Book a free strategy call](https://peachtreeva.multisites.ai/contact)[or email info@peachtreeva.com](mailto:info@peachtreeva.com) ![Sarah Harlan, Client Experience & Operations Manager](https://peachtreeva.multisites.ai/_astro/sarah-harlan.DtVquYwL_2b0Qn7.webp) ![Darleen Priday, Vice President of Business Development](https://peachtreeva.multisites.ai/_astro/darleen-priday.jiyh6aPr_1PLR4H.webp) ![November Lee, Marketing Manager](https://peachtreeva.multisites.ai/_astro/november-lee.Cro_USs7_Z1Yhdwg.webp)