After-hours coverage for MSPs: a staffing problem, not a tooling one

Why the night is a staffing problem, and why a rotation is several people

You can route every alert to a phone, an on-call schedule and a PSA ticket, and the night still fails if the person on the other end can't act on it. Tooling moves an alert to a human. It doesn't put a qualified one on the schedule, rested and holding the runbook. If your on-call rotation is really the same few senior engineers, you already know the cost: the person paged at 2am works the next day tired or doesn't work it at all. A second alerting tool doesn't change who carries the pager. Before you plan anything, pull a quarter of after-hours tickets and alerts from your PSA and RMM and count how many needed a person. If a large share was noise, fix the alert tuning first, because volume sets how many seats you need.

The arithmetic is short. A week has seven nights, and one person works fewer of them than that. Add planned absences, illness and the public holidays of that person's own country, which don't match yours, and a single seat leaves gaps you can see coming. So nights plus weekends takes several people on a written schedule. Twelve hours a night for seven nights is 84 hours, and someone working a 40-hour week covers about 40 of them, so two people can't cover it and three can, before any absence. The exact number depends on the hours you need watched, how much overlap you want between people, and whether a gap for an absence gets covered by another person on the rotation or by your own team.

Each person works the hours you agree with us, so the window is named up front and the region follows from it. A Philippine workday falls in the US evening and overnight, because the Philippines sits 12 hours ahead of US Eastern during US daylight time and 13 hours ahead from November to March. Central Mexico sits within two hours of Eastern all year, so a night seat there is a night shift for the person in it. Start with the window that hurts most, often the weekend or the hours right after your day team logs off, then add people until the schedule holds.

Overnight NOC, overnight service desk and overnight security are three jobs

An overnight NOC seat watches the RMM alert queue, verifies backups, works the patch window and triages what fires, escalating whatever the runbook can't close. Of the three it is the most procedural, since the work can be written down as runbooks, happens inside your own tools and is the easiest to hand to someone new. The page on NOC technicians goes through the seat in detail.

An overnight service desk seat takes user tickets while your day team is off, and it only makes sense if your agreements promise after-hours support. The work is whatever those agreements cover: lockouts, outage reports, the urgent line. It needs stronger language skills than a NOC seat and a tighter escalation path, because a person on the other end is having a bad night. If your agreements don't promise it, don't build it.

Security overnight is a different discipline again. Tier 1 triage of EDR and MDR alerts can be done remotely, but declaring an incident or calling the client is a decision for someone senior and US-side, and whether the seat may isolate an endpoint on a detection your runbook pre-approves is a call you make and write down. An MSP that would rather buy security monitoring than staff it can buy MDR, and the page on SOC analysts covers when a staffed analyst seat makes sense.

Five ways to cover the night, and when each one fits

Your own night shift fits when your volume and your agreements justify full-time overnight staff, and when you can hire and keep US people who want those hours. It gives you the most control at the highest cost, and it's the right answer for any client environment that must stay US-only. A US on-call rotation fits when nights are quiet enough that waking someone is the exception.

A distributor's or white-label after-hours desk fits when you want the night handled as a service, with their staff, their tools and their process, and you don't manage the people. MDR fits security alerts you'd rather buy than staff. If you want a fully managed after-hours desk that you never manage, a white-label provider may serve you better than Dokimo. Dokimo is for MSPs who want dedicated people inside their own process.

Dedicated international staff fit when you want the night worked in your PSA and RMM, by people who follow your runbooks and answer to your service delivery manager. Employment and payroll run through Dokimo's employer of record (EOR) partner in each person's own country. Dokimo won't quote a time to shortlist, so it fits an overnight gap you plan for, not one that opens next week. If the overnight queue is quiet, give the seat standing work, such as patch follow-up and documentation, or you'll pay for idle hours.

Nights this model can't cover, and what stays with your US team

It's the wrong answer for on-site work, because nobody in this model goes to a client site, racks a server or swaps a drive. It's the wrong answer if you need cover for a holiday stretch or a seasonal rush. A seat takes time to recruit and ramp, so it doesn't suit a short spike. And it's the wrong answer if you expect one seat to cover every night or every weekend, since that takes several people.

Client environments come next, and they're your decision. Some are effectively closed to anyone outside the US, such as environments with export-controlled defense data and criminal justice systems, and Dokimo won't place a remote tech on them. Most other limits are contract or insurance terms that vary, and the page on offshore techs and client contracts covers them, HIPAA included. A client that blocks sign-ins from outside the US in its own tenant will lock an overnight technician out, so find that out before the seat starts.

Start a new international seat on client environments you've already cleared, with access run through your own tools. Keep client-facing advice, anything signed, declaring a security incident and taking a client system down with your US team. You choose which clients the person in the seat may touch, and Dokimo fits the seat to your answer. Nothing here is legal advice. Your agreements and your counsel decide.