Many businesses still treat the VPN as their remote access security plan. For Microsoft 365 that model no longer fits: email, Teams, SharePoint and OneDrive live in the cloud, so tunnelling traffic back to the office adds delay without adding much protection. Good Microsoft 365 remote work security moves the checks to where the risk actually is, the identity and the device, and keeps a modern tunnel only for the few apps that still live on a server in a closet. This post lays out that model and the order to build it in.
Why the VPN stopped being the security boundary
A traditional VPN answers one question: is this person allowed onto the network? Once connected, they usually reach far more than they need. Meanwhile the data that matters most, mail and files, is not on that network at all. It sits in Microsoft 365, reachable from any browser with a valid username and password.
That is why the attacks we see against hybrid workforces rarely involve the VPN. They involve a phished password, a stolen session token, an unmanaged home PC syncing the whole finance share, or a personal phone with no PIN holding a year of client email. None of those are fixed by a tunnel.
The replacement model has four layers:
Strong identity checks on every sign-in
Conditional Access policies that decide what each sign-in can do
Managed, healthy devices, or app-level protection on personal ones
Per-app private access for the remaining on-premises systems
Layer 1: Identity that holds up away from the office
Remote work turns the sign-in page into your front door. Make it hard to walk through.
Require MFA for every user, not just admins, and prefer Microsoft Authenticator with number matching or passkeys over SMS.
Use phishing-resistant methods for admins and finance staff. Passkeys or FIDO2 security keys stop adversary-in-the-middle phishing kits that capture one-time codes.
Block legacy authentication. Older protocols cannot do MFA and are a favorite target for password spraying.
Turn on self-service password reset so remote staff are not calling the help desk to unlock accounts, which is where social engineering often starts.
If MFA is only partly rolled out today, our MFA enablement service handles the rollout and the user communication.
Layer 2: Conditional Access as the new perimeter
Conditional Access is the policy engine in Microsoft Entra ID. It requires Entra ID P1, which is included in Microsoft 365 Business Premium and E3. Each policy says: for these users, accessing these apps, under these conditions, require these controls.
A starting set that works for most hybrid businesses:
Policy
Target
Control
Require MFA
All users, all cloud apps
Multifactor authentication
Block legacy auth
All users
Block
Require compliant device for desktop apps
All users, Office 365
Device marked compliant in Intune
Protect mobile access
iOS and Android
Require app protection policy
Limit browser access from unmanaged PCs
All users, SharePoint and Exchange
App enforced restrictions (web only, no download)
Admin protection
Directory roles
Phishing-resistant MFA
High-risk sign-ins (Entra ID P2)
All users
Require MFA or block
Always exclude two break-glass emergency accounts from every policy, and roll new policies out in report-only mode first so you can see who would be affected before you switch them on.
Avoid relying on location rules as your main control. “Allow from the office IP” made sense when everyone sat in the office. In a hybrid model it mostly creates exceptions that attackers can exploit if they get onto a trusted network.
Layer 3: Devices you can trust, or apps you can contain
Company-owned laptops
Enroll them in Intune, ideally through Windows Autopilot so they arrive at a home address and configure themselves on first sign-in. Then apply a compliance policy that requires BitLocker, a supported OS version, Defender Antivirus running and a minimum Defender for Endpoint risk level. Conditional Access then grants full desktop app access only to compliant devices.
Windows Autopatch, or Windows Update for Business rings managed through Intune, keeps remote machines patched without anyone visiting the office.
Personal phones and tablets
You rarely need to enroll a personal phone. Intune app protection policies apply directly to Outlook, Teams and OneDrive: a PIN on the app, no copy-paste into personal apps, no saving to personal storage, and the ability to wipe only company data when someone leaves. See our BYOD for Microsoft 365 approach for the details.
Personal home computers
These are the hardest case. A reasonable middle ground is browser-only access with download blocked, enforced through Conditional Access session controls. Staff can read and edit in the browser but cannot sync the file library to an unmanaged machine.
Layer 4: Private apps without the old tunnel
Most mid-size businesses still have something on-premises: a line-of-business app, a file server, an accounting database. For those, Microsoft Entra Private Access, part of Global Secure Access, offers a zero trust alternative to a VPN.
Users run the Global Secure Access client. Traffic to the private apps you define is routed through Microsoft’s network to a lightweight private network connector inside your environment, and every connection is subject to Conditional Access. You can start with Quick Access, which mirrors your existing VPN ranges, then narrow to per-app access so each user reaches only the specific servers and ports they need.
Licensing: Private Access requires Entra ID P1 or P2 plus a Microsoft Entra Private Access or Microsoft Entra Suite license. For many firms the better long-term move is to retire the on-premises app entirely or move it to Azure, but Private Access bridges the gap cleanly.
A practical rollout order
MFA for everyone and legacy authentication blocked
Break-glass accounts and baseline Conditional Access in report-only, then on
App protection policies for mobile
Intune enrollment and compliance for company laptops
Compliant-device requirement for desktop apps
Browser-only controls for unmanaged PCs
Private Access for remaining on-premises apps, then retire the VPN
Do remote workers need a VPN to use Microsoft 365 securely?
No. Microsoft 365 is designed to be reached directly over the internet. Security comes from MFA, Conditional Access and device compliance. A VPN can actually slow Teams calls and file sync by routing cloud traffic through the office.
What license do I need for Microsoft 365 remote work security?
Microsoft 365 Business Premium covers most of it: Entra ID P1 for Conditional Access, Intune for device and app management and Defender for Business for endpoints. Risk-based policies need Entra ID P2, and Private Access needs its own license.
How do I stop staff syncing company files to home computers?
Use a Conditional Access policy that requires a compliant device for desktop and sync clients, and apply app enforced restrictions so unmanaged devices get browser-only access with downloads blocked.
Want to know how your remote access stacks up? Book a free Microsoft 365 security assessment and we will review your Conditional Access, device compliance and MFA coverage.
Many businesses still treat the VPN as their remote access security plan. For Microsoft 365 that model no longer fits: email, Teams, SharePoint and OneDrive live in the cloud, so tunnelling traffic back to the office adds delay without adding much protection. Good Microsoft 365 remote work security moves the checks to where the risk actually is, the identity and the device, and keeps a modern tunnel only for the few apps that still live on a server in a closet. This post lays out that model and the order to build it in.
Why the VPN stopped being the security boundary
A traditional VPN answers one question: is this person allowed onto the network? Once connected, they usually reach far more than they need. Meanwhile the data that matters most, mail and files, is not on that network at all. It sits in Microsoft 365, reachable from any browser with a valid username and password.
That is why the attacks we see against hybrid workforces rarely involve the VPN. They involve a phished password, a stolen session token, an unmanaged home PC syncing the whole finance share, or a personal phone with no PIN holding a year of client email. None of those are fixed by a tunnel.
The replacement model has four layers:
Layer 1: Identity that holds up away from the office
Remote work turns the sign-in page into your front door. Make it hard to walk through.
If MFA is only partly rolled out today, our MFA enablement service handles the rollout and the user communication.
Layer 2: Conditional Access as the new perimeter
Conditional Access is the policy engine in Microsoft Entra ID. It requires Entra ID P1, which is included in Microsoft 365 Business Premium and E3. Each policy says: for these users, accessing these apps, under these conditions, require these controls.
A starting set that works for most hybrid businesses:
Always exclude two break-glass emergency accounts from every policy, and roll new policies out in report-only mode first so you can see who would be affected before you switch them on.
Avoid relying on location rules as your main control. “Allow from the office IP” made sense when everyone sat in the office. In a hybrid model it mostly creates exceptions that attackers can exploit if they get onto a trusted network.
Layer 3: Devices you can trust, or apps you can contain
Company-owned laptops
Enroll them in Intune, ideally through Windows Autopilot so they arrive at a home address and configure themselves on first sign-in. Then apply a compliance policy that requires BitLocker, a supported OS version, Defender Antivirus running and a minimum Defender for Endpoint risk level. Conditional Access then grants full desktop app access only to compliant devices.
Windows Autopatch, or Windows Update for Business rings managed through Intune, keeps remote machines patched without anyone visiting the office.
Personal phones and tablets
You rarely need to enroll a personal phone. Intune app protection policies apply directly to Outlook, Teams and OneDrive: a PIN on the app, no copy-paste into personal apps, no saving to personal storage, and the ability to wipe only company data when someone leaves. See our BYOD for Microsoft 365 approach for the details.
Personal home computers
These are the hardest case. A reasonable middle ground is browser-only access with download blocked, enforced through Conditional Access session controls. Staff can read and edit in the browser but cannot sync the file library to an unmanaged machine.
Layer 4: Private apps without the old tunnel
Most mid-size businesses still have something on-premises: a line-of-business app, a file server, an accounting database. For those, Microsoft Entra Private Access, part of Global Secure Access, offers a zero trust alternative to a VPN.
Users run the Global Secure Access client. Traffic to the private apps you define is routed through Microsoft’s network to a lightweight private network connector inside your environment, and every connection is subject to Conditional Access. You can start with Quick Access, which mirrors your existing VPN ranges, then narrow to per-app access so each user reaches only the specific servers and ports they need.
Licensing: Private Access requires Entra ID P1 or P2 plus a Microsoft Entra Private Access or Microsoft Entra Suite license. For many firms the better long-term move is to retire the on-premises app entirely or move it to Azure, but Private Access bridges the gap cleanly.
A practical rollout order
For device management at scale, our Intune managed service covers steps 3 to 6. Microsoft’s own overview of the VPN replacement piece is in Learn about Microsoft Entra Private Access.
Frequently asked questions
Do remote workers need a VPN to use Microsoft 365 securely?
No. Microsoft 365 is designed to be reached directly over the internet. Security comes from MFA, Conditional Access and device compliance. A VPN can actually slow Teams calls and file sync by routing cloud traffic through the office.
What license do I need for Microsoft 365 remote work security?
Microsoft 365 Business Premium covers most of it: Entra ID P1 for Conditional Access, Intune for device and app management and Defender for Business for endpoints. Risk-based policies need Entra ID P2, and Private Access needs its own license.
How do I stop staff syncing company files to home computers?
Use a Conditional Access policy that requires a compliant device for desktop and sync clients, and apply app enforced restrictions so unmanaged devices get browser-only access with downloads blocked.
Want to know how your remote access stacks up? Book a free Microsoft 365 security assessment and we will review your Conditional Access, device compliance and MFA coverage.