Hybrid Work: How to Set Up Secure and Efficient IT Support

Hybrid work is here to stay, even as offices have filled up again. The problem is that many solutions were set up in a rush in 2020 and have not been updated since. Let's look at what a well-organized hybrid environment looks like today.

TL;DR — Key Takeaways

• Identity is the new network perimeter — MFA and Conditional Access are mandatory.
• Manage company devices centrally (Intune or equivalent); keep private devices separate.
• Data should live in SharePoint/OneDrive, not on laptop desktops.
• Remote support requires a tool with an audit trail and user consent.

What Defines a Managed Hybrid Environment

A managed hybrid environment means an employee accesses work data just as securely from the office, home, or on the road, while IT knows which device was used and whether it complies with security requirements. Technically, we build this around identity: Entra ID, MFA, Conditional Access, and device management.

VPNs haven't disappeared, but their role has narrowed: we use them to access internal systems not published in the cloud, while email, documents, and Teams run directly via Microsoft 365 with appropriate policies.

Why Improvised Solutions Become a Problem

Solutions set up in haste usually only reveal their flaws during an incident or audit.

• Open RDP to the internet remains one of the most common entry points for ransomware.
• Uncontrolled private devices mean unmonitored access to business data.
• Data on local laptop disks is not backed up.
• Without MFA, a stolen password means immediate access to email and documents.

How to Get Started — Recommended Process

1. Implement MFA for all users and eliminate exceptions.
2. Close direct RDP access and replace it with a VPN or published access with MFA.
3. Enroll devices in central management and set up disk encryption.
4. Migrate work files to SharePoint/OneDrive with a synchronization policy.
5. Set up Conditional Access based on device, location, and sign-in risk.
6. Implement a remote support tool with session logging and user consent.

Best Practices for Each Scenario

Common Mistakes

The most frequent mistake is trying to solve hybrid work security with a single tool — for example, just a VPN. A VPN protects the connection, but not the identity, the device, or the data on it.

Another mistake is excessive strictness without explanation. If a policy hinders work, employees will find a workaround (private WeTransfer, personal email), which actually decreases security.

How VitalIT Can Help

At VitalIT, we build hybrid environments around Microsoft 365 and Azure, taking care of devices, access, and remote support. For a comprehensive setup, see Cloud and Microsoft 365.

Related articles: Microsoft Intune: Central Device Management and Passkeys: The Future of Passwordless Logins.

Frequently Asked Questions (FAQ)

Do we need a VPN if we are fully on Microsoft 365?

Often not. A VPN remains only for internal servers or devices in the local network.

How should we handle employees' private devices?

Allow access via a browser with download and storage restrictions or require device registration.

How much does the setup cost for 30 employees?

Most components are included in Microsoft 365 Business Premium licenses; the cost is primarily a one-time setup and training.

Does MFA disrupt employees?

With modern methods (app, passkeys), login prompts are rare — typically only on new devices or risky sign-ins.

Where are access logs stored?

In Microsoft 365 and in the remote support tool; the retention period is determined based on your requirements.