How to remove VA access the same day (and make it easier next time)

What does it mean to remove VA access?

Removing VA access means ending every route a virtual assistant or contractor had into your business accounts, not just ending the contract. A route is anything that still works after they leave: a user seat, a password they read, a browser session, a 2FA code on their phone, an app connection, or a recovery email.

Most owners revoke the obvious seat and miss the rest. This checklist closes all of them in one working day, calmly, whether the engagement ended well or badly.

If you are offboarding a salaried staff member instead, the same logic applies; the employee offboarding password checklist covers the details this guide skips.

Step 1: What could your VA see or use?

Start with an inventory, because you can only revoke what you know about. Spend fifteen minutes writing a list before you change anything, so you change things in the right order.

Go through these places:

• Shared logins: passwords sent in chat, email, a spreadsheet or a shared note.
• Their own seats: accounts created in their name inside your tools (email, CRM, help desk, project boards, ad accounts, website admin).
• Shared inboxes and calendars: delegated mailboxes, forwarding rules they set up, calendar sharing.
• Files: shared drives, folders shared to their personal address, links set to "anyone with the link".
• Money: company cards saved in their browser, virtual cards, payment platform logins, invoicing tools.
• 2FA: any account whose verification code goes to their phone, their email or their authenticator app.
• Connected apps: scheduling tools, automation tools or browser extensions they connected to your accounts.

Search your chat history with them for words like "password", "login" and "code". It is the fastest way to find credentials you forgot you sent.

Step 2: Which access should you revoke first?

Revoke access in order of damage: money and email first, then anything that can reset other accounts, then everything else. Your main email account can reset most other passwords, so it matters more than any single tool.

If the departure is hostile, do the top three rows before you tell them, or in the same hour.

Step 3: How do you rotate passwords your VA knew?

Change every password the VA could read, starting with the accounts at the top of your risk table. A password someone has seen should be treated as known, even if you trust them, because their device or notes could be compromised later.

1. Open the account and change the password to a new, unique, randomly generated one.
2. Use the service's "sign out of all devices" or active sessions option if it has one, because changing a password does not always end existing sessions.
3. Check the recovery email and phone number are yours, not the VA's.
4. Remove any app passwords or API keys created while they had access.
5. Update the new password in your password manager so the rest of the team is not locked out.

NIST SP 800-63B advises against forced periodic changes but says to change a password when there is evidence it may be compromised. A departing person who saw it is a sensible reason. See how often you should change passwords for the wider rule.

Step 4: What about 2FA codes on the VA's phone?

Move every two-factor method the VA held to a phone, inbox or authenticator the business controls before you cut their access. If you remove their access first, you may find the only device that can approve a sign-in is in their pocket.

• SMS codes: change the phone number on the account to a business number.
• Authenticator apps: re-enroll 2FA so a new secret is created; the old one on their phone stops working.
• Email codes: point the account at a business address, not their personal one.
• Backup codes: generate a fresh set, because old saved codes may still work otherwise.

Re-enrolling the authenticator matters. Changing only the password leaves the VA's authenticator generating valid codes. The guide to sharing 2FA codes with a team explains how to set this up so no single person holds the only copy.

How do you check nothing was missed?

Run a final review the next day, with fresh eyes, against your inventory list. Tick off each line only when you have confirmed the change, not when you meant to do it.

• Each service's user list no longer shows the VA.
• Active sessions on key accounts show only devices you recognise.
• No forwarding rules send mail to an outside address.
• Shared files are no longer shared with their address.
• Recovery details on email, domain, payment and social accounts are business-owned.
• Any audit log or login history shows no access after their end time.

Keep the list. It becomes your starting inventory for the next contractor.

How can you make removing VA access easier next time?

The easiest way to remove VA access is to never hand over the password in the first place. If the VA can sign in without seeing the password, there is far less to rotate when they leave.

Three habits make the next offboarding short:

1. Give named seats where tools allow it, so removing a user removes access.
2. Share passwords through a password manager, not chat, so you have one list of what each person can reach.
3. Use fill-only sharing for logins the VA needs but should not know, as explained in Login only access for contractors.

In BobWork Vault, a free password manager for teams, you can share a password or a folder with a teammate at Owner, Edit, View or Login only level. Login only means the Chrome extension fills the login, but the teammate can't see or copy the password. Login only members never receive stored backup codes, and when a site asks for a 2FA code they can use "Ask for the code": the holder sends it encrypted to that teammate only, and it expires in 10 minutes.

When the engagement ends, the guided offboarding flow removes their access, hands over anything they owned, re-keys the remaining shared items and builds a checklist of passwords to change on each site. Removing the teammate also ends their signed-in vault session right away, and the audit log records the actions. If you are choosing a company password manager for staff and contractors, these are the controls worth comparing.

Should you remove access before or after telling the VA?

For a friendly ending, remove access at the agreed end time, after any handover is complete. For a sudden or hostile ending, remove access to money, email and admin accounts first, then tell them.

Either way, ask the VA to hand over work files, notes and any 2FA they hold before access closes, and agree in writing that they will delete credentials they kept. You still rotate the passwords; the agreement is a courtesy, not a control.

Try BobWork Vault — free for your whole team

BobWork Vault is a free, zero-knowledge password manager for teams, made by BobWork (BobOffice, LLC). Shared folders, login-only access, 2FA codes and guided offboarding, end-to-end encrypted. Add it to Chrome or create a free account.

Keep reading

• How to share a password without revealing it to contractors, agencies and interns
• Employee offboarding checklist: what to revoke, rotate and hand over
• How to share 2FA codes with your team without waiting for one person's phone

More: free password manager · free team password manager · free company password manager · company password manager · password management software · how to share passwords with teammates · compare password managers