The US Bureau of Labor Statistics reports a median annual wage of $48,310 for secretaries and administrative assistants in May 2025, before benefits and payroll taxes. For an MSP with eight or ten people, a full-time local hire at that level is a large commitment for work that arrives in small pieces: scheduling, chasing invoices, tracking renewals, filing paperwork, and answering routine email. So the owner does it, in the gaps between the work that earns the revenue.
This post covers what an offshore virtual assistant can take over from an MSP owner, what should stay with you, and how to give access to your mailbox and calendar without sharing passwords, using the delegate permissions already built into Microsoft 365. It also covers how to start, how to tell whether it is working, and when an administrative hire is not the right fix.
The Cost of Doing Admin Yourself
BLS data, last modified in August 2026, puts the median wage for secretaries and administrative assistants at $48,310 and for bookkeeping, accounting, and auditing clerks at $50,670, against a median of $47,450 for the whole office and administrative support group and $50,980 for all occupations. BLS projects that overall employment in office and administrative support will decline between 2025 and 2035, while about 1.7 million openings a year will arise from workers leaving the occupations. Those figures describe the US labor market for these roles in general and say nothing specific to MSPs, but they show the baseline an owner is comparing against: a full-time salary for a role that most small MSPs need only in part.
The practical cost is the owner's time. An MSP owner's hour is worth more than an administrator's hour, and the work that gets displaced is usually the work only the owner can do: selling, client relationships, pricing, and technical direction. When admin tasks pile up, they also tend to slip, and the slippage shows up as late invoices, missed renewals, and slow replies. A virtual assistant is one way to fix that without hiring a full-time local employee, though it only works if the tasks are well defined and the access is set up carefully.
What an MSP Owner's Admin Load Looks Like
The work falls into several groups. The first is inbox and calendar management: sorting email, drafting routine replies, scheduling client and vendor meetings, and keeping the calendar free of conflicts. The second is billing follow-up: sending invoices, chasing overdue payments, reconciling what was billed against what the contract says, and flagging disputes for the owner. The third is renewals and vendor administration, which includes tracking contract and license renewal dates, collecting quotes, processing distributor and partner program paperwork, and keeping track of certifications and compliance deadlines.
The fourth is people administration: onboarding paperwork for new hires, scheduling interviews, and tracking time off and equipment. The fifth is reporting and research: compiling the numbers for a monthly review, researching prospects or vendors, and formatting documents. None of these need technical judgment, which is why they suit an assistant, and all of them can be written down as a repeatable process, which is why they suit delegation.
What to Hand Over and What to Keep
The line between delegating and abdicating is access and decision rights. A virtual assistant can prepare, draft, track, and chase. The owner decides, approves, and signs. The table below sets out a common split for an MSP, with the access each task needs so that you can match it to the permissions section that follows.
| Task area | What the assistant does | What stays with the owner | Access needed |
|---|---|---|---|
| Inbox and calendar | Sorts mail, drafts routine replies, schedules and reschedules meetings | Replies about pricing, contracts, escalations, or anything sensitive | Delegate access to your mailbox and calendar |
| Billing follow-up | Sends reminders, tracks overdue accounts, prepares a weekly aging summary | Disputes, payment plans, write-offs, and any call to a sensitive client | View and limited update access in your billing system, with no payment approval rights |
| Renewals and vendors | Tracks renewal dates, gathers quotes, completes portal paperwork | Choosing vendors, approving spend, and negotiating terms | Shared tracker and vendor portal accounts under the assistant's own login |
| People administration | Prepares onboarding checklists, schedules interviews, tracks time off | Hiring decisions, pay, and performance matters | Limited access to HR documents, scoped to what the tasks need |
| Reporting and research | Compiles reports from exported data, researches prospects and vendors, formats documents | Interpreting the numbers and deciding what to do | Read-only exports, not live admin access to your PSA or client systems |
Several things should stay out of an assistant's hands entirely. Do not give a virtual assistant administrative access to client tenants, your RMM, or your security tools, because that work needs technical training and carries the highest risk. Do not give anyone approval rights over payments. Keep client escalations and anything that creates a contractual commitment with you. If you find yourself wanting an assistant to do something technical, you probably need a technician instead, and Konnect's piece on the one-person IT team problem covers that case.
Giving Access Without Sharing Passwords
The most common mistake is sharing the owner's login. It removes any record of who did what, it breaks multi-factor authentication, and it gives the assistant everything, including things the role does not need. Microsoft 365 has a better mechanism built in, and it works at the level of detail the table above calls for.
Microsoft's guidance on calendar edit and delegate permissions says you can give anyone within your organization editor or delegate access to your calendar, and that you cannot give editor or delegate access to people outside your organization. For an MSP, that has a practical consequence: the assistant needs their own named account in your tenant, with a license, rather than an outside email address. A delegate automatically receives Send on Behalf permission, messages sent that way show both the delegate's name and yours in the From line, and there is a setting that controls whether the delegate can see events you marked private. That visible dual name is a useful property, since recipients can see the message came from your assistant on your behalf.
Microsoft's instructions for sending email on behalf of someone else explain how to grant the narrowest version. Setting the Calendar, Tasks, Inbox, Contacts, and Notes options to None gives the delegate the basic ability to send messages on your behalf and nothing more, and you can add permissions individually, such as Calendar at Author level or Inbox at Reviewer level. Start there and widen the access only when a real task requires it.
The Microsoft 365 admin documentation on giving mailbox permissions to another user distinguishes three kinds of permission, and the difference matters. You can allow a user to read and manage a mailbox, which Exchange calls Full Access, to send on behalf of the mailbox owner, or to send as the mailbox owner. Full Access does not include either sending permission. Send on Behalf leaves a visible trace that the message came from a delegate. Send As does not, so treat it as the higher-risk option and avoid it unless there is a specific reason.
| What the assistant needs to do | Permission that fits | Notes |
|---|---|---|
| Manage your meetings and respond to invitations | Calendar delegate access | The delegate receives meeting messages and can act on them. Decide whether private events are visible. |
| Read your inbox to triage it | Inbox at Reviewer level, or a shared folder | Keep sensitive mail, such as HR and legal, out of the folders the assistant can see. |
| Send routine replies for you | Send on Behalf | Both names show in the From line, which keeps the arrangement visible. |
| Handle a shared mailbox, such as accounts or billing | Read and manage plus Send on Behalf on the shared mailbox only | Separating billing mail from your own inbox limits what the assistant can see. |
| Send mail that appears to come from you alone | Send As | Higher risk and leaves no trace of the delegate. Use rarely, if at all. |
Beyond Microsoft 365, apply the same logic to every other system. Give the assistant their own login to your billing, CRM, and vendor portals, and use a password manager with a vault that holds only the credentials the role needs. Require multi-factor authentication on the assistant's account, work from a managed device where you can, and sign a confidentiality agreement before access begins. The assistant will see client names, pricing, and contract terms, so treat that as client data and apply the same standards you would for a technician. Keep a written list of what the assistant can access, and review it whenever their tasks change.
Getting Started
Start with a task list, not a job title. Write down everything you did in the last two weeks that was not selling, delivery, or decision making, and note roughly how long each item took and how often it recurs. Group the items, and pick the three groups that cost the most hours and follow the clearest process. Write a short standard operating procedure for each, including what done looks like, what the assistant may decide alone, and what must come to you first. Recording a short screen capture of yourself doing the task often produces a better procedure than writing it from memory.
In the first week, the assistant works under close supervision, with every outgoing message reviewed before it is sent. In the second and third weeks, review samples and shift to exceptions. Agree a daily check-in at a fixed time, a shared task board, and a response-time expectation for urgent items. Manila's working day overlaps with the US morning if the assistant works an afternoon and evening shift, and overlaps largely with the Australian working day, so check-ins fit comfortably into either schedule. Konnect's guide to remote onboarding best practices covers how to run the first weeks.
Measuring Whether It Works
Measure against your own baseline. Before the assistant starts, record how many hours a week you spend on the delegated groups, how long invoices stay overdue on average, how many renewals were missed or late last year, and how long routine emails sit before a reply. After thirty and sixty days, compare. The numbers that matter are the hours you reclaimed and what you did with them, since an assistant who saves ten hours that disappear into more admin has solved nothing. Also track errors: the messages you had to correct, the tasks you had to redo, and the items that fell through. A rising error rate in the second month usually means the procedures are unclear, not that the person is wrong for the role.
Where a Virtual Assistant Does Not Fit
Several situations call for something else. If your real bottleneck is technician capacity, with tickets waiting and overnight calls landing on you, an administrative hire will not help, and a helpdesk technician is the better use of the budget. If the recurring admin amounts to only a few hours a week, a part-time arrangement or automation inside your PSA and accounting system may fit better than a full-time hire. If the work depends on judgment calls you cannot describe, delegation will fail until you can. And if you have no documented process for a task, the assistant will inherit the confusion, so write the process first.
The employment questions are the same as for any offshore hire. Find out who legally employs the assistant, how pay and statutory benefits are handled, and what the confidentiality terms say. Treat a full-time assistant who works your hours, with your tools and your supervision, as an employee for planning purposes, and confirm the structure with your provider and with counsel if you are unsure.
A Thirty-Day Plan
In the first week, log your administrative time and pick the three task groups to hand over. In the second week, write the procedures, create the assistant's named account in your tenant, and set the narrowest delegate permissions that cover the first tasks. In the third week, start with supervised work, with a review of every outgoing message. In the fourth week, move to sample review, widen access only where a task needs it, and compare the hours and error counts against your baseline. At the end of the month you should know which tasks the assistant owns, which still need you, and which access you can tighten or extend.
📅 Book a 20-minute call: https://meet.brevo.com/konnectph
✉️ Email us: hello@konnect.ph
If you are an MSP owner who spends part of every week on scheduling, invoicing follow-up, and renewals tracking, bring a log of that time to the call, and we will go through which tasks suit an offshore administrative or sales support hire, which ones should stay with you, and how the access should be set up.
About the Author
Vilbert Fermin is the founder of Konnect, a remote staffing company connecting North American and Australian businesses with top Filipino talent. With deep expertise in IT support and remote team management, Vilbert helps MSPs access skilled technical professionals without the overhead of full-time domestic IT staff. His mission is to showcase Filipino excellence while helping businesses stay protected, productive, and competitive through strategic remote staffing.
