Four rules for virtual assistant access
- The assistant uses their own login. Delegation features in your email, calendar and documents let them sign in as themselves, so actions are logged under their name and you never share your main password.
- Grant the narrowest permission that covers the task. Read-only is better than edit, and edit is better than admin.
- Where a tool has no delegation feature, share that one login through a business password manager, never by email, chat or spreadsheet.
- Keep a written list of every access you grant, so offboarding takes minutes.
Email and calendar delegation in Google Workspace and Microsoft 365
Google Workspace and Gmail let you add a delegate who can read, send and organize mail in your mailbox while signed in to their own account. Calendar sharing is set separately. Microsoft 365 offers mailbox and calendar delegation in Outlook, with distinct permissions for reading mail, sending on behalf of you (the recipient sees both names) and sending as you. Pick the option that matches how you want replies to look, and grant no more than that. The day-to-day use of that access is described in inbox management for founders and executive calendar management.
Sharing logins with a password manager
For tools with no delegation option (airline accounts, some vendor portals, subscription services), business password managers let you share individual items or a dedicated shared folder or vault with the assistant. Ask for these settings:
- A separate shared vault for assistant work, so nothing else is visible
- Item-level sharing, with the option to hide the password while still allowing auto-fill where the manager supports it
- Activity logs, so you can see what was accessed
- Access removal that takes effect immediately when the engagement ends
Keep banking, payroll admin, tax portals and your password manager's own master account out of shared vaults unless there is a specific, written reason.
Two-factor sign-in for assistant accounts
Every account the assistant uses should have two-factor sign-in on the assistant's own device or authenticator. Avoid setups where the assistant has to ask you for a code each time. That habit trains both of you to read codes out over chat, which is what phishing relies on. Never share a code you didn't request yourself.
What a virtual assistant should not do
Money
Approve payments, move funds, change payee or bank details, or use a company card beyond an agreed limit and purpose.
Commitments
Sign contracts, accept terms, or agree prices or deadlines on your behalf, unless a written rule covers that exact case.
Speaking as you
Write as you on HR, legal, investor, press or personal matters without your explicit review.
Data handling
Forward company data to personal accounts, store passwords in notes or documents, or paste confidential content into outside tools (including AI tools) without your permission.
Security settings
Change your passwords, recovery email, recovery phone or two-factor methods, or add new delegates.
Unverified requests
Act on urgent requests for payments, gift cards or credentials that arrive by email or text, even if they look like they come from you. Confirm through a second channel first.
Offboarding checklist for a virtual assistant
- Remove mail and calendar delegation and document sharing
- Remove the assistant from shared password-manager vaults, then change passwords for any shared logins
- Revoke any app passwords, connected apps or sessions created for the work
- Remove the assistant from team chat, project tools and shared drives
- Collect any notes, playbooks or task lists into your own storage
For broader guidance on account security, the US Cybersecurity and Infrastructure Security Agency publishes plain-language advice on securing accounts.
Security questions to ask a provider
What devices will the assistant work on?
Ask whether work happens on a dedicated, updated device with disk encryption and a screen lock, and whether the provider has a written policy for this.
Will the same person work on my account each day?
Ask who has access, how cover works during holidays, and whether a backup person needs separate access.
Will you sign our confidentiality agreement?
Ask before sharing anything. Most providers expect to sign an NDA and agree confidentiality terms in the service contract.
Want this handled for you? Tell us what fills your inbox and calendar, and a service partner will reply with a proposed scope.
Request a proposal