← All Blogs

Who at Your MSP Can Log Into Your Systems at 2am?

By Best IT MSP Editorial Team - Updated October 20, 2026 - 11 min read

The Best IT MSP editorial team maintains this directory's provider data across the US and Canada. We rank providers on verified rating and firmographic data, label paid placement, and do not sell IT services.

Who at your MSP can log into your systems at 2am?

Three or four named engineers at a well-run provider, plus two or three accounts nobody remembers creating. That second group is the problem. Most owners cannot name a single one of them, and the access is real whether or not it is written down anywhere you can see.

Your provider holds standing administrative rights across everything you own. That is normal and necessary. Being unable to answer three questions about it is not.

• Who specifically holds privileged access to your systems, by name and by role level?
• Is every privileged session recorded, where is the recording kept, and for how long?
• How fast is that access revoked when one of their engineers leaves, and who verifies it?

2am is not a figure of speech. Sophos parsed 661 incident response cases and found 37.1 percent of attacks fell in the four hours between 11pm and 3am, with 88.10 percent of ransomware deployed during non-business hours. The window when nobody is watching is the window attackers pick.

This guide covers the privileged layer only, meaning the accounts that can change your systems rather than read a file. For the wider nine-check pass across every provider account, read Audit Your MSP's Access. What follows goes a level deeper, into session recording, revocation speed, and what privileged access management actually costs a company your size.

Why your provider's breach becomes your breach

Because an attacker who compromises your provider inherits the standing access that provider already holds in every client at once. One set of credentials, hundreds of networks, no extra work. That is why this class of supply chain attack is so efficient, and it is the part buyers almost never price in. The risk is not your provider acting badly. It is arithmetic.

Microsoft Threat Intelligence documented the mechanism in March 2025. The group it tracks as Silk Typhoon was abusing stolen API keys and credentials associated with privilege access management platforms, then using stolen API keys to access downstream customers and tenants of the initially compromised company. Once inside, the actor was resetting the default admin account via API key and clearing logs of actor-performed actions. Hold on to that last detail. It decides where your session recordings should live.

CISA documented a second route in June 2025. Ransomware actors exploited an unpatched SimpleHelp remote monitoring and management instance to compromise the downstream customers of a utility billing software provider, through a path traversal flaw catalogued as CVE-2024-57727. An RMM tool is the one piece of software holding agent-level rights on every machine you own, which makes it the highest-value target in the relationship.

Seven national cyber authorities compressed the warning into one sentence. Threat actors can use a vulnerable provider as an initial access vector to multiple victim networks, with globally cascading effects. Verizon's 2026 data now puts a third party in 48 percent of breaches, up 60 percent in a year, against a global average breach cost of 4.99 million dollars. Third-party access stopped being an edge case.

Question 1. Who specifically holds privileged access, and at what level?

Three to five named engineers at a well-run provider, each with an individual account you can see in your own directory. Ask for names and role levels in writing, not a team name. You can audit the whole list in one email.

Five account types belong on that list, and most owners only know the first one exists.

• Domain admin and Global Administrator accounts, which can change anything in your estate.
• Local admin rights on individual laptops and servers, usually granted once and never reviewed.
• Service accounts, which Microsoft describes as accounts intended to represent a non-human entity such as an application, API, or other service.
• RMM tool agent accounts, which reach every managed device at the same time.
• Break-glass account credentials, the emergency pair held for a lockout.

CISA publishes a federal configuration baseline you can borrow word for word. Its Microsoft Entra ID baseline requires that a minimum of two users and a maximum of eight users be provisioned with the Global Administrator role, that privileged users be provisioned with finer-grained roles instead of the Global Administrator role, and that privileged users be provisioned cloud-only accounts separate from an on-premises directory. Count your own Global Administrators against that cap this week.

Then check the second factor on every one of them. Microsoft Research measured that multi-factor authentication reduces the risk of compromise by 99.22 percent across the entire population studied, and Sophos still found MFA was not enabled or not fully configured in 59.46 percent of incidents. A shared admin login with no second factor is the finding most likely to be sitting in your tenant right now.

Question 2. Is every privileged session recorded, and who keeps the recording?

Yes at a mature provider, and the recording belongs somewhere you can reach and they cannot delete. Ask the three parts together. Whether each privileged session is recorded, where the file is stored, and how long it is kept. Session recording turns "we logged in to fix a printer" into something you can watch.

Cost is rarely the real obstacle. ConnectWise publishes its ScreenConnect list prices, and session recording sits in the Standard plan at 47 dollars per concurrent technician per month, billed annually, with video auditing in the Premium plan at 57 dollars. For a provider running ten technicians, that is the difference between roughly 5,640 and 6,840 dollars a year. A ten dollar monthly gap per engineer is a preference, not a budget constraint.

Retention is where the control usually fails quietly. Sophos reported that among cases with missing logs, retention issues doubled over last year, largely driven by firewall appliances where the default was only seven days, and in some cases 24 hours. Seven days of evidence against a median dwell time Sophos now puts at three days leaves almost no margin for a slow discovery.

Storage location is the non-obvious part, and it follows directly from the Silk Typhoon findings. An actor with your administrative rights clears logs on the way out. A recording that lives only inside the tenant that attacker now administers is not evidence. Ask that privileged session recordings be held in an independent location your provider's everyday credentials cannot delete, and that you can request any session from the last 12 months and receive it inside two business days.

A recording your provider can delete is a courtesy. A recording they cannot delete is a control.

Question 3. How fast is privileged access revoked when an engineer leaves?

Within hours at a well-run provider, with written confirmation sent to you. Ask for the deadline in hours and ask who verifies it. "Same day" is an intention. "Within four hours, confirmed by email to you" is a control you can enforce.

National guidance pushes hardest on this check, because it is the one that fails without anybody noticing. The joint advisory tells customers to disable MSP accounts that are no longer managing infrastructure and warns that doing so can be overlooked when a contract terminates. Its own list of immediate actions opens with a single line, identify and disable accounts that are no longer in use.

Offboarding has a physical half that people forget. Microsoft's guidance on emergency access says to maintain at least two emergency access accounts, to validate account functionality at least every 90 days, and to regularly change the combinations on any safes and after someone with access leaves the organization. If your break-glass password sits in a drawer at your provider's office, one departure is a credential rotation event, and somebody has to rotate it.

Speed matters because attackers move faster than paperwork. Sophos measured attempts to reach Active Directory speeding up by 70 percent in a year, down to a median of just 3.40 hours, and found 67.32 percent of root causes were related to compromised identity. A dormant privileged account left live for a fortnight is a fortnight of unmonitored opportunity.

Standing privilege is the risk. Just-in-time access is the fix.

Standing privilege means an account carries administrative rights all the time, whether anybody is using them or not. Just-in-time access replaces that with rights switched on for a named task, for a set number of minutes, then switched off automatically. The second model removes the window the first model leaves open permanently.

CISA's federal baseline states the rule without hedging. Permanent active role assignments SHALL NOT be allowed for highly privileged roles, and the stated reason is provisioning access when the roles are needed, in other words just in time. The same baseline requires that provisioning users to highly privileged roles SHALL NOT occur outside of a PAM system and that activation of the Global Administrator role SHALL require approval.

Translate that into what your provider does on an ordinary Tuesday. An engineer asks to elevate, a second person approves the request, the role activates for one hour, the tool records the session, and the rights expire on their own. Nobody has to remember to revoke anything afterwards. That is least privilege made operational rather than aspirational.

Credential vaulting is the companion control. The administrator password lives in a vault, an engineer checks it out for a specific job, the vault rotates it on return, and no person ever knows the current value. Paired with time-bound roles, a leaked note or a stolen laptop hands an attacker nothing that still works.

What privileged access management costs a 50-person company

About 600 dollars a year for the just-in-time layer, because privileged access management is licensed per privileged user rather than per employee. That single detail is where most quotes to small businesses go wrong, and it is worth checking line by line.

Microsoft lists Entra ID P2 at 10.00 dollars per user per month and Entra ID Governance at 7.00 dollars per user per month, both billed annually. Privileged Identity Management, the engine behind eligible and time-bound roles, is a P2 feature. Microsoft's own licensing guidance scopes it tightly, requiring licences for users with eligible or time-bound assignments to roles managed using PIM, users able to approve or reject activation requests, and users assigned to or performing access reviews.

Run that for a 50-person business with three internal admins and two provider engineers. Five privileged users at 10 dollars a month is 50 dollars a month, or 600 dollars a year. The same sum done per head returns 6,000 dollars. The gap is not a discount you negotiated. It is the difference between licensing privilege and licensing people.

Know what that spend does not buy. PIM governs cloud role elevation and logs who approved each activation. It does not record a screen. Screen-level session recording for remote support lives in the RMM tool instead, which is exactly why questions one and two are separate questions. Price the two controls as two line items and the conversation stops being about buying a platform.

Does a 50-person company need a PAM platform?

No in most cases, and yes to three of its controls. A 50-person business rarely needs a dedicated PAM platform with its own console. It does need named accounts, time-bound elevation and a revocation deadline, and all three are available inside licences most firms already hold.

Five requirements carry almost all of the benefit.

• Require a named individual account for every provider engineer, with no shared admin login.
• Enforce multi-factor authentication on every privileged account, with no exclusion group attached.
• Record privileged sessions, and store the recordings where your provider cannot delete them.
• Revoke access inside an agreed number of hours, confirmed in writing to you.
• Review the privileged account list once a quarter and disable anything dormant.

A dedicated platform earns its keep later. The usual triggers are an on-premises server estate, a compliance auditor asking for an audit trail, or more than one supplier holding third-party access. Below that threshold, a platform mostly adds a dashboard nobody opens and a renewal nobody questions.

One market note from our own dataset. Best IT MSP holds 22,027 company profiles across 633 US and 99 Canadian city markets, and we rank on verified rating and firmographic data rather than on what a provider tells us about itself. The practical consequence is that answers to these three questions vary far more between providers than between tools. Compare the cybersecurity services a firm actually operates, then look at a ranked market shortlist such as managed IT providers in Dallas.

The email to send on Tuesday

Send six lines and a deadline. CISA's own advice to the customers of a compromised provider was to confirm whether your third-party vendors use RMM software, what security controls they have, and how they handle patching, so none of this reads as an adversarial request to a competent firm.

• List every privileged account your team holds in our systems, by name and role level.
• State which of those accounts carry standing privilege and which are time-bound.
• Confirm whether privileged sessions are recorded, where they are stored, and for how long.
• Send one recorded session from the last 30 days as evidence the recording works.
• Give the revocation deadline in hours for a departing engineer, and name who verifies it.
• Name the contract clause that makes the five answers above contractual rather than friendly.

Judge the reply on whether it contains numbers. A provider that answers with five names, two role levels, a 12-month retention figure and a four-hour revocation deadline is operating privileged access management, whatever it calls the practice internally. A provider that answers with a product name has also told you something.

None of this delivers perfect security, and no honest provider claims it does. It delivers a verifiable answer to three questions you currently cannot answer, which is the entire gap. Ask the same three questions of two other firms in your city and compare the three replies side by side.

FAQ

Should my MSP have domain admin rights to my network?

Rarely, and never permanently. CISA's federal configuration baseline requires that permanent active role assignments not be allowed for highly privileged roles and caps the top role at a minimum of two users and a maximum of eight users. Your provider should hold eligible, time-bound elevation an approver switches on for a named task.

What is standing privilege, in plain terms?

Standing privilege is an administrator account that keeps its powers all the time, used or not. Just-in-time access replaces it with rights that activate for a set period and expire on their own. CISA's baseline calls for provisioning access when the roles are needed, in other words just in time.

Does a 50-person company need privileged access management?

It needs the controls, not usually a dedicated platform. Microsoft lists Entra ID P2 at 10.00 dollars per user per month and scopes Privileged Identity Management licences to users with eligible or time-bound role assignments, approvers and reviewers. Five privileged accounts cost about 600 dollars a year, not fifty seats.

Can I ask my MSP to record its remote sessions?

Yes, and the cost objection is small. ConnectWise lists session recording in the ScreenConnect Standard plan at 47 dollars per concurrent technician per month, with video auditing in Premium at 57 dollars. Ask for recordings to be stored where your provider's everyday administrative credentials cannot delete them.

How quickly should my MSP revoke an engineer's access after they leave?

Within hours, with written confirmation to you. The joint advisory tells customers to disable MSP accounts that are no longer managing infrastructure and warns this can be overlooked when a contract terminates. Sophos measured attackers reaching Active Directory in a median of just 3.40 hours, so days are too slow.

← All Blogs