Which Permissions Should You Give a Remote Property Management Accountant?

Team Cadre
November 10, 2026

Back

Enough access to reconcile and prepare. Not enough to move money or to change who approves it.

That is the whole answer, and the rest of this article is the specific version of it. The useful part is not the grant list. It is the withhold list, because four capabilities account for nearly all of the damage a compromised or careless accounting login can do, and all four are easy to withhold without slowing the work down at all.

A note on how this is written. Every major platform names its permissions differently, and those names change between releases. Rather than publish a list of menu labels that will be wrong in six months, this guide is organized by capability, meaning the thing the person can actually do. Map each capability to whatever your own system calls it.

The principle: separation of duties, not trust

The instinct is to treat this as a trust problem. How much do I trust this person? That framing produces bad setups in both directions, because it leads you to over grant for someone who seems reliable and over restrict someone who then cannot do the job.

The better framing is separation of duties, and it has nothing to do with the individual. The person who records a transaction should not be the person who authorizes it. The person who reconciles an account should not be the person who can move money out of it. That rule applies identically to a twenty year in-house controller and to someone hired last month on another continent. If your in-house setup violates it, remote staffing is not the problem you have.

Separation of duties also happens to be what an auditor is looking for, which is why the arrangement below is defensible rather than merely cautious.

The grant list: what a remote accountant needs

Capability	Needed?	Why
View tenant, owner and property ledgers	Yes	The entire job
Enter and code receipts and disbursements	Yes	Core data entry
View bank transactions and import bank feeds	Yes	Reconciliation input
Perform and save account reconciliations	Yes	Core task
Create and view financial reports	Yes	Month end package
Enter bills and build an approval queue	Yes	AP preparation
Prepare owner distribution calculations	Yes	Monthly cycle
View lease terms and charge schedules	Yes	Needed to explain variances
Add notes, flags and comments on transactions	Yes	How they escalate problems
View vendor records	Yes	AP coding
Export reports and data	Usually	Needed for reporting. Scope it to the properties they handle.

That set is sufficient for a remote accountant to run a full property management close. Nothing on the withhold list below prevents any of it.

The withhold list: the four that matter

If you do nothing else from this article, withhold these four.

1. Adding or changing bank account details

This covers your operating and trust account records inside the platform, and it covers vendor and owner payment details. Changing where money goes is the single highest value target in any accounting system, and it is the mechanic behind most payment fraud. A remote accountant has no reason to need it. When banking details legitimately change, that should be a two person event with out of band verification, meaning you call a number you already had on file rather than one from the email requesting the change.

2. Releasing payments, printing checks or initiating ACH

Preparing the payment run and releasing it are two different actions, and every major platform can separate them. The accountant prepares. A named person with authority releases. On trust accounts this is not merely good practice: in most states the release of client funds sits with the broker, and in some states signature authority is restricted by rule.

3. Creating a new vendor

Vendor creation plus payment release is the classic fraud pair. Even without release authority, an unreviewed new vendor capability lets a bad actor stage half of the scheme and wait. Route new vendors through an approval, and require a W-9 on file before the record goes live.

4. Changing permissions, approval chains or user accounts

This is the one people forget, and it quietly undoes the other three. Any user who can edit the permission structure effectively has every permission. Administrative rights stay with a small, named internal group. Never with placed staff, never with an outside bookkeeper, never temporarily.

Two more are worth withholding as a close second tier. Editing or reopening a closed accounting period rewrites history that someone has already relied on, so restrict it and handle corrections as current period adjusting entries instead. And manual journal entries are the legitimate tool for fixing almost anything, which is also why they are the tool for hiding almost anything, so allow them to be prepared and require them to be reviewed.

How the major platforms handle permissions

Each system expresses access differently. Exact labels vary by version and by how your instance was configured, so treat the following as the shape of each model rather than a menu path.

Yardi

Yardi Voyager has the most granular model of the four. Access is controlled across several layers: roles and permission groups, function level permissions, menu configuration, and property or entity level access. The function permission model spans thousands of individual functions, which means Yardi can express every row of the tables above precisely, and also means a sloppy setup is easy to produce and hard to spot.

Yardi also supports workflow approval routing, which is the second place separation of duties gets enforced. Prepare and approve splits should be built there, not only in the permission grid. Entity level access is the feature to use if the remote accountant should only see part of your portfolio. Scope first, then set function permissions inside that scope.

AppFolio

AppFolio uses role based access with configurable permissions. The practical approach is to build a dedicated role for the remote accounting function rather than reusing a property manager or administrator role, both of which carry far more than this job needs.

The high risk actions to exclude from that role: adding or modifying bank accounts, posting or approving payments, creating or modifying vendors, editing the general ledger structure or chart of accounts, posting manual journal entries, and editing closed periods.

Buildium and RealPage

Both use role based access control. Build a purpose made accounting role rather than adapting an existing one, and apply the same grant and withhold lists. Because role templates in any system tend to be generous by default, check what a template actually includes before assigning it rather than trusting the name.

Setup checklist

Create a dedicated role. Do not reuse an existing one. Name it for the function, not the person.
Scope to the properties they handle. If they are on 40 of your 300 doors, they see 40.
One named login per person. Never a shared account. Shared logins destroy the audit trail, which is the thing that makes the whole arrangement defensible.
Require multi factor authentication. No exceptions for remote staff, and use an authenticator app over text messages where the platform offers one.
Apply the withhold list, then verify it by having the person attempt one withheld action and confirming it fails.
Build the approval chain before go live, not after the first payment run.
Set a review cadence. Monthly review of changes to vendor records and bank related fields, quarterly review of who has what.
Write down the offboarding steps now. Deactivate the login same day, reassign in flight items, and confirm the deactivation rather than assuming it.

What this costs you in speed

An honest tradeoff, because the arrangement above is not free.

Prepare and approve adds a step. If your approver is slow, your payment runs get slower. A property manager who was previously doing everything themselves will feel this as friction, and some firms respond by granting release authority to get the time back.

That trade is usually a mistake, but it is a real trade, and the right answer is to fix the approval bottleneck rather than collapse the separation. In practice that means naming a specific approver and a specific window rather than leaving approvals to whoever notices.

Frequently asked questions

Can a remote accountant work in AppFolio or Yardi from another country?

Yes. These are cloud platforms and access is a permissions question, not a geography question. If you want to restrict access by location or IP range, check whether your platform and your IT setup support it, and be aware it can break when the person travels or their home connection changes.

How do I keep an audit trail?

One named login per person, never shared, plus whatever change logging your platform provides. Review changes to vendor and bank fields monthly. A shared login means you cannot attribute any action to any person, which defeats the purpose of the permission structure in the first place.

What if the remote accountant needs an exception for one task?

Grant it narrowly, in writing, with an end date, and remove it when the task is done. Temporary elevations that nobody removes are how permission structures decay.

Does any of this change if they work on trust accounts?

The permission logic is the same, but the stakes and the rules are different. Several states restrict who may be a signatory on a broker trust account, and the broker remains responsible regardless of who does the work.

Should remote staff use a company device or a VPN?

Device and network controls sit in a separate layer from permissions and both matter. Permissions decide what someone can do once they are inside the system. Device and network controls decide how safely they get there. Set expectations on both before the first login, and write them into the engagement rather than leaving them assumed.

Working with TeamCadre

TeamCadre places full time remote accounting and finance professionals from Latin America with US companies, with a focus on property management. Vetting includes software proficiency verification alongside a technical screen on US GAAP and accounting knowledge, background checks and professional reference checks.

Placements are made through an Employer of Record arrangement, with payroll, HR and compliance handled in country. There is no placement fee and no upfront cost, and every one year contract includes a three month evaluation period during which you pay only for hours worked.

If you are planning to add remote accounting support and want to get the access structure right from the first day, get in touch.