How do charities give staff and volunteers secure access from anywhere?

Why volunteer access is different

Over a million people volunteer in Scotland (SCVO, 2026). Volunteers join and leave often, may give a few hours a month, use their own phones and laptops, and may work from community halls, shops, outreach vans or home. Many handle personal information about the people you support. The goal is quick access for the right people and none for anyone else.

Accounts: one person, one login

Shared logins, such as a single "volunteers@" mailbox everyone knows the password to, are one of the most common gaps we find. You can't tell who did what, you can't use multi-factor authentication properly, and you can't remove one person's access.

• Give every staff member and volunteer their own account. Microsoft 365 Business Basic is free for up to 300 paid staff and trustees under Microsoft's nonprofit offers. Volunteers need discounted licences or guest access
• Turn on multi-factor authentication for everyone, including trustees
• Use groups by role, so access follows the role and not the person
• Use Teams guest access for partners, rather than full accounts

Starters and leavers

A simple, written process prevents most problems:

• Starters: a named manager requests the account, it's added to the right role groups, and training on phishing and data protection happens in the first week
• Leavers: account blocked on the last day, licence removed, charity data wiped from their devices, shared passwords changed
• Every quarter: review who has access to sensitive folders and remove anyone who shouldn't

Microsoft's nonprofit programme monitors licence use and warns when fewer than 85% of assigned licences are active, so leavers' licences should be removed promptly anyway.

Devices: charity-owned and personal

Charity-owned laptops and tablets should be enrolled in Microsoft Intune: encrypted, updated automatically, protected by endpoint security and able to be wiped remotely if lost.

Volunteers' own phones don't need to be fully managed. Intune app protection policies keep charity email and files inside Outlook, Teams and OneDrive, stop copying into personal apps, and let you wipe only the charity data when someone leaves.

Shared devices in drop-in centres or shops should use separate sign-ins and lock automatically.

Connectivity for community sites and outreach

Community venues often have poor or shared WiFi. Options:

• A managed 4G or 5G router for temporary or outreach sites
• Full fibre (FTTP) for permanent offices and shops where it's available
• Separate guest WiFi for visitors and service users, kept apart from staff systems
• Secure remote access to any systems still in the office

Training that fits volunteers

Volunteers won't sit through an hour-long course. Short, regular modules on phishing, passwords and handling personal data work better. Only 17% of UK charities ran any cyber awareness activity in the last year (DSIT, 2026), so even a little puts you ahead.

How Indigo does this. Indigo Unified Communications sets up staff and volunteer accounts, role-based access and Microsoft Intune for charities across Scotland from our Glasgow office. Our Charity package includes setting up and removing accounts quickly, Intune for shared and personal devices, and security awareness training. Every support ticket gets a first response in under 30 minutes (13 minutes on average in September 2026), and managed 4G and 5G connectivity for new sites is usually live within 2–3 working days.