Do I need to set up a VPN for remote workers?

Not for Microsoft 365, Teams and most cloud services: those connections are already encrypted. A VPN is only needed when staff need something on the office network, such as a local server, an old application or a printer.

Can an employee work on their own PC at home?

Preferably not. You do not manage a personal PC: you do not know whether it gets updates, who else uses it or what is installed. Give remote workers a managed work laptop and only allow Microsoft 365 from managed devices.

Is public wifi in a café or hotel dangerous?

With a managed, up-to-date laptop, MFA and encrypted connections to Microsoft 365, the risk is limited. Do watch who can see your screen or hear you, and if in doubt use your phone’s hotspot instead of an unknown network.

Should I manage my employees’ home routers myself?

For an SME that is usually unnecessary and hard to arrange. Focus on the work laptop and the account, and give staff a short guide: update the router, change the default password and put smart devices on a separate network.

Working from home securely: what an SME should arrange for the work laptop and home network

At the office, a lot is taken care of: there is a firewall, someone keeps an eye on the network and the printer is not open to the neighbours. At home, things are different. The work laptop shares the wifi with phones, smart lights and a housemate’s laptop, on a router that has never had an update. Still, working from home securely does not have to be complicated. Most of the gain is in the laptop itself and the account you sign in with, not in expensive equipment in everyone’s home.

Why working from home is a different risk

At the office, the network and the people around you catch a lot. At home, the laptop is on its own. An attacker does not need to break into your office if a poorly secured router, a housemate’s infected PC or a stolen password gets them in just as well. The good news: Microsoft 365 and your files are in the cloud, so the office network is no longer the only way in. If you get the laptop and the account right, you have done most of the work.

Start with the laptop, not the home network

You have little control over the router in an employee’s home, but you do control the work laptop. So arrange these points for every device, even if it never comes to the office:

Managed remotely: the laptop is under your management, for example through Microsoft Intune, so settings and software are the same everywhere.
Updates that actually happen: Windows and the main applications update automatically, and someone checks that it works. How to set that up is covered in Windows updates and patch management.
Encryption: turn on BitLocker, so a laptop stolen from a car or train does not become a data breach.
No admin rights: a user who can install anything will eventually install the wrong thing. See local admin rights on laptops.
Antivirus and monitoring: security software that sends alerts to your IT partner, not just a pop-up the employee clicks away.

The account is the real front door

Most break-ins at small businesses start with a stolen password, not a hacked router. So turn on MFA for everyone, management included. With conditional access you can also make Microsoft 365 work only from laptops that are managed and meet your requirements. If someone signs in from an unknown personal PC, they do not get access to mail and files. A password manager helps people use a different password for every service.

The home network: three simple steps

You do not need to put a business firewall in every employee’s home. Do ask remote workers for these three things:

Update the router: check whether the router still receives updates. A router from the internet provider is often updated automatically; an old router someone bought themselves sometimes no longer is at all.
Change the passwords: change the router’s default admin password and use a strong wifi password with WPA2 or WPA3.
Separate where possible: put smart devices, games consoles and visitors on a guest network, and the work laptop on the main network. The idea is the same as guest wifi at the office, just smaller.

Most small businesses no longer need a VPN to reach Microsoft 365, because those connections are already encrypted. A VPN only makes sense when staff need something at the office, such as an old server or a printer.

Agreements matter as much as technology

Technology catches a lot, but a few agreements make the difference:

Work happens on the work laptop, not the family computer. If you do want to allow mail on personal phones, arrange it with work apps on personal phones.
Files live in OneDrive, SharePoint or Teams, not on the desktop or a USB stick.
The laptop locks when someone walks away, at home too, and housemates do not use it.
Confidential video calls do not happen on a terrace or a train where others can listen in.
There is one number or address where staff report that something odd is happening, or that their laptop is lost or stolen.

A quick check for your remote workers

Ask these five questions: are all work laptops managed, do they demonstrably get updates, is BitLocker on everywhere, is it impossible to sign in without MFA, and does every employee know where to report a problem? If the answer is no or “I don’t know” anywhere, that is the first thing to fix. The router at home comes after that.

What Floor ICT does

Floor ICT manages workplaces remotely, so it makes no difference to us whether a laptop is at the office or at home. In every package we keep up with Windows updates, monitoring and inventory, and help remotely. From Advanced, antivirus and ransomware protection are added, and Elite also includes managed workplace backup and extra endpoint security. We set up MFA and the access rules in Microsoft 365 with you and prepare a short guide for remote workers. You decide which devices and locations get access, whether personal phones are allowed and what you ask of staff for their home network.

View MSP packages Request an intake Microsoft 365