In this guide · 8 sections
Short answer
Move files to OneDrive, SharePoint or Google Drive, turn on MFA for every account, and enrol company laptops in device management (Intune or Google endpoint management) so they're encrypted, updated and wipeable. You often don't need a VPN unless staff reach an office server. Agree who handles IT help.
The remote team IT stack at a glance
Most remote setups for small businesses come down to six layers. Get them right in this order.
| Layer | What to use | Why |
|---|---|---|
| Identity | Microsoft 365 or Google Workspace accounts with MFA | One login per person you can turn off on their last day |
| Files | OneDrive and SharePoint, or Google Drive shared drives | No files stuck on one laptop or an office PC |
| Devices | Intune, Google endpoint management or another MDM | Encryption, updates and remote wipe without seeing the laptop |
| Communication | Teams, Google Meet or Zoom, plus a chat channel | Meetings and quick questions in one place |
| Passwords | A business password manager | Shared logins without sending passwords in chat |
| Support | Named contact, hours and a ticket or chat channel | Problems get fixed instead of worked around |
For video tools, our comparison of Zoom, Teams and Google Meet covers costs and features.
Accounts and MFA: secure sign-in first
When staff work from home, cafes and while travelling, a stolen password is the most likely way in. Microsoft's security defaults documentation says most compromising sign-in attempts come from legacy authentication, which doesn't support MFA, and that security defaults are available on the free tier of Microsoft Entra ID. Turning them on requires MFA and blocks legacy sign-in. Google Workspace admins can enforce 2-Step Verification for everyone.
- Every person has their own account; no shared logins for email or files.
- MFA enforced for all users, with an authenticator app or passkeys rather than SMS where possible.
- Admin accounts separate from daily accounts, with at least two admins so one person's leave doesn't lock you out.
- A password manager for shared logins such as supplier portals and social media.
Our MFA set-up guide walks through both platforms.
Devices: managed laptops shipped ready to work
Company laptops for remote staff should be managed from day one, so you can enforce encryption and updates and wipe a lost device. Microsoft lists Intune in Microsoft 365 Business Premium; Windows Autopilot uses the Windows already on a new PC and applies your settings and apps from the cloud, so a laptop can be delivered straight to an employee's home.
Choose and register devices
Buy from a vendor or reseller that can register the laptops to your tenant, or register them yourself before shipping.
Set baseline policies
Disk encryption (BitLocker or FileVault), automatic updates, screen lock, firewall and antivirus on.
Pre-assign apps
Office or Google Drive for desktop, browser, password manager, video tools and anything role-specific.
Ship to the employee
They sign in with their work account; the device configures itself and appears in your device list.
Check compliance weekly
Look for devices that are unencrypted, out of date or haven't checked in.
If staff use their own phones or laptops, you need different rules; see our BYOD and MDM guide.
Do you still need a VPN?
A VPN connects a remote laptop to your office network as if it were in the office. Many small teams bought one in 2020 to reach a file server. If your files and apps are now in the cloud, the VPN mostly adds cost and slows things down.
You probably need a VPN if
- Staff must reach an office file server, accounting server or NAS
- A line-of-business app only works on the office network
- A supplier or client only allows access from a fixed IP address
You probably don't if
- Files are in OneDrive, SharePoint or Google Drive
- Apps are cloud services with MFA, such as Xero or HubSpot
- You enforce MFA and manage devices
If you do keep a VPN, require MFA on it, keep the VPN device or software updated, and remove leavers' access on their last day. Unpatched VPN appliances are a common way into small networks.
Home Wi-Fi and working from public places
You can't manage staff home routers, but you can set expectations and reduce what depends on them.
Home and remote working basics
Put these in your IT policy so staff know what's expected; our IT security policy template has a devices section you can extend.
Support across time zones
Remote IT problems are harder to see and easier to ignore. A short support plan prevents a broken laptop from costing a day of work.
- One channel for IT issues (a support email, ticket form or chat channel), not personal messages to whoever seems technical.
- Published support hours, and what counts as urgent outside them, such as a lost device or suspected hack.
- Remote support tool installed on managed laptops, so help doesn't depend on screen sharing in a meeting.
- A spare laptop or fast replacement plan for staff far from the office.
- A written onboarding and offboarding checklist that whoever handles HR can follow.
If you're weighing in-house support against a provider, see IT support costs in Singapore.
Do it yourself or get help?
A small team on Microsoft 365 or Google Workspace can turn on MFA and move files to the cloud themselves. Device management, Autopilot and compliance policies take more setup, and mistakes can lock people out.
Our Device Encryption & Management (S$490) enrols laptops and phones, enforces encryption and updates, and sets up remote wipe. Our Microsoft 365 / Google Security Lockdown (S$590) enforces MFA, blocks legacy sign-in and tightens sharing settings for a remote team.
Frequently asked questions
Business accounts with MFA (Microsoft 365 or Google Workspace), cloud file storage, device management for company laptops, a video and chat tool, a password manager and a clear support channel. Most small remote teams don't need office servers or a VPN once files and apps are in the cloud.
Only if they must reach something on your office network, such as a file server, NAS or an app that only works in the office, or a service that only allows a fixed IP address. If files are in OneDrive, SharePoint or Google Drive and apps are cloud services with MFA, a VPN usually adds little.
Use device management with automatic enrolment. With Windows Autopilot and Intune, a new laptop applies your settings and apps when the employee signs in with their work account, so it can ship straight to their home. Google Workspace and Apple Business Manager offer similar options for their devices.
Enforce disk encryption, automatic updates, screen lock and antivirus through device management, keep files in cloud storage rather than only on the laptop, and make sure you can remotely lock or wipe the device. Require MFA on all accounts so a stolen laptop or password alone isn't enough.
Disable their accounts on the last day, transfer their files and mailbox to a manager, revoke access to shared logins and change any shared passwords, then lock or wipe their company laptop through device management. Arrange courier return of equipment, and remove them from chat groups and supplier portals.