Do these 3 things before closing this tab:
1Repair Windows errors before they cause bigger problems2Fix the driver behind crashes, sound loss and screen glitches3Clear out junk files and repair common Windows errorsiTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
Give an insurance virtual assistant (VA) a separate, named account for each agency system they need, limit its permissions to assigned work, and require multifactor authentication (MFA) wherever the system supports it. Before access begins, decide which device and connection path are acceptable, record who approved the access, and assign an internal owner to review and revoke it.
Plan access around the VA’s actual tasks
Start with the work, not a broad request for system access. List each task the VA will perform, the application needed for it, and the minimum customer information and actions required. An agency administrator should confirm what each application can restrict—for example, by user, record, role, or action—because capabilities and labels vary by system.
Use the list to approve access system by system. Avoid giving a VA access to an entire agency-management platform, mailbox, file store, or business account merely because one task requires a limited part of it. NIST’s SP 800-171 Revision 3 says to restrict privileged accounts to designated personnel or roles and to use non-privileged accounts for non-security work. CISA likewise recommends least privilege for administrative functions, separation of duties, and strong authentication such as MFA in its cloud business applications guidance.
Create a separate account and limit its permissions
Ask the administrator for a named account tied to the VA—not a staff member’s credentials, a shared login, or a generic administrator account. Individual accounts make it possible to associate activity with the person who performed it and to change or end that person’s access without disrupting another employee.
#1 Best Overall
- POWERFUL SECURITY KEY: The Security Key C NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key C NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key C NFC via USB-C and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
Assign only the roles and permissions needed for the approved tasks. Keep security administration separate from ordinary work: a VA who enters or updates customer information should not receive administrator privileges unless a specific approved duty requires them. Microsoft’s identity security guidance recommends least privilege, limiting and reviewing delegated access, and avoiding shared administrator accounts.
Require MFA and choose stronger sign-in for administrators
Turn on MFA for each account wherever the identity provider and application support it. Check both: an organization’s identity provider may offer an authentication method that a connected application does not accept. Do not assume MFA is in force across every system just because it is enabled for email or a central sign-in.
Rank #2
- POWERFUL SECURITY KEY: The YubiKey 5C NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5C NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5C NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
For any account with administrative privileges, prefer phishing-resistant MFA if the identity provider and applications support it. A FIDO2 security key is one possible option, but confirm compatibility before making it the required method. Microsoft recommends phishing-resistant MFA for tenant administrators in its identity security guidance. Its Partner Center guidance also describes MFA and granular delegated privileges for partner-tenant accounts; that is product-specific guidance, not a rule for every insurance agency system.
The Tool Desk
Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Set the device and connection rules before access starts
Decide whether the VA must use an agency-managed or agency-approved device, and whether access can be limited by device or connection path. Managed-device and device-based controls can reduce reliance on the user’s local environment, where available; Microsoft discusses these controls in its Microsoft Entra best-practice guidance.
Rank #3
- POWERFUL SECURITY KEY: The YubiKey 5 NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5 NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5 NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
If the work involves sensitive access from a personal or partner-managed device, assess whether an agency-controlled remote desktop or similar intermediary is appropriate. An intermediary can make the agency’s environment the point of access rather than granting unrestricted local access, but suitability depends on the systems, configuration, and agency risk decisions. Confirm the actual application and identity-provider capabilities with the agency administrator rather than assuming a particular control is available.
Keep an access record and assign an owner
Name an internal person responsible for approving and maintaining the VA’s access. Keep a record for each system that includes:
Rank #4
- POWERFUL SECURITY KEY: The Security Key NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key NFC via USB-A and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
- the VA’s name and the system or account;
- the approved tasks and permission level;
- the approver and date access was granted;
- the next review date; and
- the person responsible for revocation.
Review external-user access periodically and whenever duties change. Remove permissions that are no longer needed. Microsoft Entra guidance recommends proofing and reviewing external identities, while Microsoft’s identity guidance recommends minimizing and reviewing delegated access.
Recommended Free Tools
Revoke access completely when work ends
When the engagement ends or the VA no longer needs a system, disable or remove the named accounts promptly, revoke active sessions where the system allows it, and check for recovery methods or delegated-access routes that could preserve access. The access owner should confirm each system on the record has been handled; removing one central account may not automatically close access in every connected application.
Best Value
- POWERFUL SECURITY KEY: The YubiKey 5 is a versatile physical passkey that protects your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5 secures 100+ of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5 via USB and tap it to authenticate. No batteries, no internet connection, and no extra fees required.
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
Check the agency’s legal and contractual duties
Security steps do not determine which privacy, security, or contractual obligations apply. The answer depends on the agency’s jurisdiction, the data involved, the systems used, and the VA’s contractual arrangement. Have the agency’s compliance or legal lead assess those specific facts before access is granted; this general security guidance is not a jurisdiction-specific legal checklist.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
