Systems administration for MSPs
Hire Remote Systems Administrators to Free Up Your Tier 3 Engineers
Your best engineer is also the one every client asks for, so the tenant baseline, the patch cycle and the restore test wait until the fire is out. A remote systems administrator, placed by Dokimo, takes that standing work. Which client environments the administrator touches is your call, and Dokimo fits the seat to it.
The Entra review, the restore test and the offboarding list
A client's mail flow breaks and your Tier 3 engineer drops the project in front of them. That's the right call, and it has a price. The Entra review due last month waits. So does the restore test nobody has run since the hypervisor upgrade, and the offboarding list with six names on it. None of it is urgent until it is. A dedicated administrator owns that queue, so it stops competing with whichever client is on the phone.
The seat covers the standing work in a Microsoft 365 and Windows estate: tenant admin and licensing, Entra identity and conditional access reviews, Intune policy, patch cycles for servers and endpoints, hypervisor hosts, Active Directory hygiene, backup jobs checked and test-restored on a schedule, and the user lifecycle from first account to last revoked token. The administrator also keeps the client documentation in your IT Glue or Hudu current, because one person owns it. They work your account only, on the tickets and projects you assign.
Settling access before the first login
Before the administrator gets a login, decide which client tenants they may touch, and check the ones you plan to start with. A client that blocks sign-ins from outside the US in its own tenant will lock a remote administrator out, and it's better to learn that before the seat starts than on the first morning. Start a new international seat on client environments you have already cleared, then widen it as the work proves out.
The access itself should run through your own tools: a named account for the administrator (never a shared login), MFA, credentials held in your vault, and session logging you can read back. Access you control centrally can be revoked the same day an engagement ends. Decisions that reach the client directly stay with your US team: advice to a client's leadership, anything that needs a signature, and any environment you keep US-only.
How a candidate is tested, and how to get a price
The price is set by the country and the level of the work. A seat that patches and offboards is a different job from one that owns identity across your whole client base. Tell us what the seat needs and we'll send a price.
The test is a piece of real work: a tenant with a broken conditional access policy to diagnose, a backup report with a failed job to explain, or a Group Policy export to review. Dokimo doesn't promise a candidate already knows your PSA, your RMM or your documentation tool. It also won't quote a time to shortlist, and would rather say so than invent a date.
The server room and the regulated client: where an administrator is the wrong answer
The tenant is remote, but the server room isn't. A remote administrator can't swap a failed drive, rack a host, image a laptop at a client's office or sit with an executive whose dock died. If your on-site work has nobody behind it, whether a local tech, a vendor on call or a client contact who can follow instructions, sort that out before you add a seat. The administrator can direct the work, but someone local has to do it.
Contracts decide the rest, and some clients belong with your US staff. What a remote administrator may touch depends on each client's agreement and data, and you decide with your counsel while Dokimo works around your answer. Some environments are effectively closed to anyone outside the US. Dokimo won't place an administrator on them: environments with export-controlled defense data, and criminal justice systems. Other limits are contract or insurance terms that vary, and health data adds agreements and a risk analysis of its own.
Short spikes are a poor fit too. A seat takes time to recruit and ramp, so it doesn't suit a short spike. A migration push or a stretch of vacation cover is better handled by a project vendor or a local temp. If the patching, backups, tenant admin and offboarding never stop, though, that's a seat, and it's the kind of work worth giving to one person.
What you get
What the engagement covers, and what is optional
One dedicated administrator, your account only
The administrator works your client base and no one else's, in your tools, on the tickets and projects you assign. Their employment and local payroll sit with Dokimo's employer of record (EOR) partner in their own country. You get one monthly invoice from Dokimo.
Reviews and restore tests on a calendar
Entra and conditional access reviews, patch cycles and backup restore tests run on a schedule you can see, so the standing work stops waiting for a quiet week.
Named accounts through your own tools
Limit the seat to the client tenants you have cleared, through GDAP roles with least privilege and no standing Global Administrator. Access should run through your own MFA, vault and session logging.
Documentation that stays current
Client documentation in your IT Glue or Hudu stays current because one person owns it.
Optional secure remote workstation
The one optional add-on, priced apart from the seat: a US-hosted virtual desktop for admin sessions, centrally revocable access, disclosed productivity and activity monitoring, and managed endpoint security. Running the seat on a device or VDI you manage works too.
Questions
Frequently asked
Can a remote systems administrator work inside my clients' Microsoft 365 tenants?
That depends on each client's agreement and data, and the decision is yours, made with your counsel. Dokimo fits the seat to your answer. A client that blocks sign-ins from outside the US in its own tenant will lock a remote administrator out, so check before the seat starts. Export-controlled defense data and criminal justice systems are effectively closed to an administrator outside the US, and Dokimo won't place one there. HIPAA alone doesn't bar work from outside the US, but health data brings agreements and a risk analysis. Nothing here is legal advice.
What does a remote systems administrator cost?
The price depends on the country and on the level of the work. Tell us what the seat needs and we'll send a price. The price covers the administrator's pay and the employer costs local law requires, year-end pay included. It also covers their employment and payroll through Dokimo's employer of record (EOR) partner in their country, the search and screening, and one monthly invoice. Licenses come from your MSP. Month to month, with no long-term contract.
What happens if the administrator is not the right fit?
If a hire isn't working out in the first 90 days, we find a replacement at no extra cost. Month to month, with no long-term contract.
Can I hire the administrator directly later?
Yes, if the seat is at Tier 3. Contract to hire and direct placement are available for Tier 3 technical and technical management seats only, so a Tier 3 systems administrator can qualify. Both end with the person hired directly by your MSP. Ask us for direct placement terms, and raise it up front so the agreement is written with that path in mind.
Roles for MSPs
Other roles for MSPs
Tell us which systems administrator seat your MSP needs
Tell us the seat, the hours you need covered and the tools you run. We'll reply with questions and the next steps, not a pitch deck.