Remote and hybrid work expands your attack surface because employees access company data from home networks, coffee shops, and personal devices that you do not control. Securing remote workers does not require enterprise-grade complexity, but it does require deliberate steps beyond what most small businesses have in place.
What You Will Need
Before you start, make sure you have the following in place:
- Microsoft 365 Business Premium (or equivalent) for Conditional Access, Intune device management, and Defender for Business. This is the license tier Athencia deploys for managed clients because it bundles identity, device, and email security into a single plan.
- A clear policy on which devices can access company data and under what conditions.
- An understanding of how your employees currently work remotely, including what devices they use, what networks they connect from, and what applications they access.
Step 1: Require MFA for All Remote Access
Multi-factor authentication is non-negotiable for any employee accessing company systems from outside the office. If an attacker steals an employee's password (through phishing, a data breach, or credential stuffing), MFA stops them from signing in.
Enable MFA on Microsoft 365, your VPN, and any cloud applications your business uses. The most effective way to do this is through Conditional Access policies in Entra ID, which let you create rules like "require MFA for all sign-ins from outside the office network" or "require MFA when a sign-in is flagged as risky." This approach enforces MFA automatically rather than relying on employees to enable it themselves.
Authenticator apps like Microsoft Authenticator are preferred over SMS text message codes for remote workers. SMS codes are vulnerable to SIM swapping attacks, and cell reception can be unreliable when working from different locations.
Step 2: Use Company-Managed Devices
Employees should access company data from company-owned, managed devices whenever possible. An unmanaged personal computer may have outdated software, no antivirus, or malware already running on it. You have no way to know.
Enroll company devices in Microsoft Intune, which is included with Microsoft 365 Business Premium. Intune lets you enforce security policies remotely: require BitLocker encryption on all laptops, require a device PIN, enforce Windows updates automatically, and remotely wipe a lost or stolen device. This is especially critical for remote workers whose laptops travel with them to coffee shops, airports, and co-working spaces.
If employees must use personal devices (a BYOD scenario), Intune's Mobile Application Management (MAM) can protect company data within managed apps like Outlook and Teams without taking control of the entire personal device. This creates a separation between personal and business data. The employee keeps their personal apps and photos; you keep your business data secure and wipeable.
Step 3: Secure the Connection
For businesses with on-premises resources like file servers or internal applications, employees need a VPN to access them securely from outside the office. If you use a VPN, make sure it requires MFA to connect. A VPN without MFA is a wide-open door if credentials are stolen.
For cloud-only environments where everything runs in Microsoft 365 and SaaS applications, a VPN may not be necessary if you have Conditional Access configured properly. Conditional Access can enforce security requirements (MFA, device compliance, location) at the identity layer, which provides similar protection without the overhead of routing all traffic through a VPN.
Regardless of your setup, advise employees to avoid public Wi-Fi for work tasks unless they are using a VPN. Open networks at coffee shops and hotels are easy targets for attackers to intercept traffic. If public Wi-Fi is unavoidable, a VPN encrypts the connection and prevents eavesdropping.
Step 4: Protect Endpoints
Every remote device needs the same endpoint protection as office devices, if not more. Remote laptops face additional risks because they are not behind the office firewall and are more likely to be lost or stolen.
Athencia deploys Microsoft Defender for Business as the endpoint protection foundation on every managed device, then layers Huntress on top to provide a 24/7 SOC with human threat hunters who actively investigate and respond to alerts. Defender handles real-time protection and threat scanning; Huntress makes sure nothing slips through by monitoring for persistent footholds, suspicious processes, and identity-based attacks. Other endpoint protection options in the SMB space include SentinelOne and CrowdStrike.
Beyond endpoint protection software, make sure the following settings are configured on all remote devices:
- Windows updates install automatically. Remote devices are not on the office network where a patch management server pushes updates, so automatic updates are essential.
- Windows Firewall is enabled. This should be on by default, but verify it has not been disabled.
- BitLocker is turned on. Full-disk encryption means a stolen laptop does not expose your data. BitLocker is included with Windows Pro and can be enforced through Intune.
- Automatic screen lock is set to 5 minutes. If an employee walks away from their laptop at a coffee shop, the screen should lock quickly.
Step 5: Control Data Access
Not every employee needs access to everything, and not every device should be trusted equally. Conditional Access policies in Entra ID let you build rules that control who can access what, from where, and on which devices.
Practical examples of Conditional Access rules for remote workers:
- Block access from unmanaged devices to sensitive data, or limit access to view-only in the browser so files cannot be downloaded to personal computers.
- Prevent syncing SharePoint or OneDrive to unmanaged personal computers. This keeps company files from being copied to devices you do not control.
- Require device compliance before allowing access. A device must meet your Intune compliance policy (updated, encrypted, protected) before it can access company resources.
- Use sensitivity labels on confidential documents to prevent forwarding, printing, or copying, regardless of where the document is accessed from.
These rules work automatically in the background. Employees on compliant, managed devices will not notice any friction. Employees trying to access data from unapproved devices will be prompted to use a compliant device instead.
Step 6: Address Home Network Risks
Employees' home routers are rarely secured properly. Default passwords are unchanged, firmware is years out of date, and the same network connects work laptops alongside smart TVs, baby monitors, and gaming consoles. You cannot fully control a home network, but you can provide guidance and focus your security on the device and connection instead.
Share these recommendations with remote employees:
- Change the default router admin password to something unique. The default password is publicly known for every router model.
- Enable WPA3 or WPA2 encryption on the Wi-Fi network. WPA and WEP are outdated and easily cracked.
- Update the router firmware. Most routers have an update option in the admin panel, typically accessible at 192.168.1.1 or 192.168.0.1.
- Separate work devices from IoT devices on different networks if the router supports guest networks or VLANs. This prevents a compromised smart device from being used as a stepping stone to the work laptop.
Recognize that home network guidance is advisory. Your real protection comes from the device-level security (endpoint protection, encryption, Intune compliance) and the identity-level security (MFA, Conditional Access) that you control directly.
Create a Remote Work Security Policy
Document your remote work security expectations in a short, practical policy. A one-page document that everyone reads and follows is far more effective than a 10-page policy that sits in a shared drive untouched. Include the following:
- Which devices are approved for remote work (company-managed only, or BYOD with MAM).
- What applications can be accessed remotely and from where.
- VPN requirements and when to use it.
- How to handle a lost or stolen device (report to IT immediately).
- Acceptable use guidelines for public Wi-Fi and shared workspaces.
Review and update the policy annually, or whenever your remote work setup changes significantly.
Need Help?
Securing remote and hybrid workers involves identity, devices, data, and network considerations that need to work together. If you want help setting up Intune, Conditional Access, and endpoint protection for your remote team, get in touch with Athencia. We help small businesses build remote work security that actually holds up.
