How do you set up secure hybrid working in 2026?

What's changed since remote working was an emergency?

In 2020 the goal was to get people working from home by Monday. Six years on, hybrid working is normal: 28% of working adults in Great Britain worked hybrid in early 2025, rising to 34% of full-time workers and 45% of those earning over £50,000 (ONS, 2025). Many of the emergency fixes from 2020, such as personal laptops, shared VPN logins and work email forwarded to personal accounts, are still in place and were never designed to last.

The security picture has shifted too. Your office firewall no longer protects most of your work, because the work happens in Microsoft 365, on laptops in kitchens, and over home broadband you don't control. Security has to travel with the user and the device.

How should home workers' devices be managed?

Every device that touches company data should be enrolled in device management. For Microsoft 365 businesses that's Microsoft Intune, which sets the rules centrally: disk encryption on, firewall on, updates installed on time, screen locks, approved apps only. With Windows Autopilot, a new laptop can be sent straight from the supplier to someone's home, and it configures itself the first time they sign in. If it's lost or someone leaves, you can lock or wipe it remotely.

Personal devices are the harder question. Letting staff read email on their own phones is normal; letting them download client files onto a family laptop isn't. Intune's app protection policies can keep company data inside Outlook and Teams on a personal phone, stopping copy-and-paste into other apps, and wiping only the work data when someone leaves. For laptops, the simplest rule is company data on company devices.

Cyber Essentials cares about this. Home workers' laptops and phones are in scope, and must meet the same firewall, update and malware rules as office devices. The home router usually isn't in scope, so the laptop's own firewall does that job. Our Cyber Essentials guide covers the detail.

Is home broadband good enough?

For most people in the Central Belt, yes. Ofcom reports that 71% of Scottish homes can now get full fibre, and only 0.4% of premises in Scotland (about 10,000) can't get decent broadband. Microsoft recommends about 2.5Mbps upload and 4Mbps download per person for good-quality Teams video meetings, which any fibre line handles comfortably.

The problems are elsewhere. Staff in rural Argyll, the Borders or the Highlands may be on slow copper-based lines, and Scotland has the lowest 4G geographic coverage in the UK, so a phone hotspot isn't always a reliable fallback. Shared households mean video calls compete with streaming and gaming. And older home lines still tied to the analogue network are affected by the PSTN switch-off in January 2027.

For key roles, it's worth the business paying for a proper connection: a business-grade SoGEA line (broadband without a phone line) or full-fibre line at the home, or a 4G/5G router with a data SIM as a backup. You can check availability for any address.

How do phones work when people aren't in the office?

With a cloud phone system, calls follow the person, not the desk. Microsoft Teams Phone puts a real phone number inside Teams on the laptop and mobile, so someone working from home takes calls to their direct line or joins a hunt group exactly as they would in the office. 8x8 and 3CX work in a similar way with their own apps. Receptionists can transfer calls to home workers, managers can see who's available, and calls can be recorded and reported on.

This matters for customers as much as staff. The caller doesn't know or care where the person is; they just want an answer. Businesses still using an office-based phone system often end up diverting calls to personal mobiles, which shows the wrong number, loses call records and becomes a problem when someone leaves. See hosted telephony for how the platforms compare.

VPN or zero trust: which do you need?

A traditional VPN connects a laptop to the office network, as if it were plugged in at a desk. That made sense when files lived on an office server. Zero trust flips the model: every sign-in is checked on who the user is, whether the device is managed and healthy, and where the request comes from, before access is granted to a specific app, not the whole network.

For most small businesses on Microsoft 365, the answer is no VPN at all: files in SharePoint and OneDrive, access controlled by Conditional Access (rules that check who is signing in, and on which device), and devices managed by Intune. If you still need one for an on-site server, keep it patched within days and protect it with MFA, because VPN gateways are among the most attacked devices on the internet.

What should a hybrid working policy cover?

Keep it short enough that people read it. It should set out which devices can be used for work, and that company data stays on them. It should explain where work can be done (home, other offices, cafés, abroad) and any rules for each, such as no confidential calls on trains and using a phone hotspot rather than public WiFi. It should cover printing and paper at home, what to do if a device is lost or stolen, and how to report a suspicious email or call.

Don't forget health and safety. The HSE's display screen equipment rules apply to people who work at home long term, so include a simple home workstation self-assessment and a budget for a proper chair, screen and headset.

Example: a 30-person consultancy with offices in Edinburgh and Livingston, where most staff work from home two or three days a week. It moves its file server to SharePoint and retires the office VPN, enrols every laptop in Intune through Autopilot, replaces the old office phone system with Teams Phone, gives its two rural-based staff 4G backup routers, and publishes a two-page policy. Nobody needs to "connect" to anything, and a lost laptop becomes an inconvenience rather than a data breach.

What about people and productivity?

Technology is the easy half. Hybrid teams work best with a few simple habits: agreed office days so people overlap, cameras on for meetings that matter, a team chat in Teams for quick questions, and judging people on outcomes rather than green status dots. Check in on new starters and quieter team members more often, because isolation is easy to miss on a screen.

How Indigo does this. Indigo Unified Communications sets up Microsoft 365 and Teams, configures laptops and phones through Microsoft Intune before they reach home workers, enforces MFA, and supplies 8x8, 3CX and Microsoft Teams Phone so calls follow people home. For multi-site businesses we provide SASE (secure, managed connections between sites and users) through Cato Networks, and our connectivity team covers business broadband, SoGEA and 4G/5G backup. Onboarding a new client usually takes about two weeks, run from our Glasgow and Livingston offices. Managed IT support →

What to do next

1. List every device used for work, including personal ones, and plan to enrol company devices in Intune.
2. Switch on MFA and Conditional Access, and decide whether you still need a VPN at all.
3. Check key staff's home connections and add a 4G/5G backup where they're weak.
4. Move phones to the cloud so calls follow people, especially before the January 2027 PSTN switch-off.
5. Publish a two-page hybrid working policy, including a home workstation check.