Managed laptops
A standard, encrypted build shipped ready to use, enrolled automatically the first time it is switched on.
Remote & hybrid working
The office moved. The security should have moved with it.
Hybrid working stopped being a project and became normal, but most businesses are still protecting a building. We manage the devices and identities instead, so where someone works stops being the thing that decides whether they are safe.
- Managed devices, anywhere
- Identity as the boundary
- Support wherever people are
- Devices enrolledand provably healthy
- Conditional accesssign-ins judged on risk
- Teams & SharePointone place for the work
- Remote supportno need to bring it in
Technologies we work with
- Microsoft
- SOPHOS
- Acronis
- HPE
- 3CX
- UBIQUITI
- veeam
What we set up
Hybrid work that is actually manageable
The difference between hybrid working that is fine and hybrid working that is a risk is almost entirely about whether the devices and identities are managed. Location is the least interesting part.
Intune management
Configuration, applications and updates pushed centrally, whether the device ever visits an office or not.
Device compliance
Encryption, patch level and protection status checked continuously — and enforced at sign-in.
MFA & conditional access
Access decided on identity, device health, location and risk rather than on being inside the building.
Microsoft Teams
Meetings, calls and chat configured with policies that suit how your teams actually work.
SharePoint & OneDrive
Files in one structured place, available offline, with sharing controls that do not rely on goodwill.
Secure remote access
VPN or Zero Trust access to the systems that still live on your own network, scoped per person.
Remote support
Helpdesk that can see and fix a device wherever it is, without anybody posting a laptop anywhere.
Endpoint security
Protection that works off the corporate network, because that is where the device now spends its life.
Onboarding
A new starter receives a laptop at home, signs in, and has everything they need. No visit required.
Offboarding
Access revoked immediately and company data removed remotely, including from a device you cannot get back today.
Policies that hold up
Acceptable use, device and remote working policies written to match what is technically enforced.
The boundary moved
The office firewall is no longer the perimeter.
When everyone worked in one building, protecting the building protected the work. Now the data sits in Microsoft 365 and the devices sit in kitchens, cafes and other countries. The thing worth protecting is the identity and the device — which is good news, because both can be managed properly.
- Every device enrolled, encrypted and reporting its health
- Company data reachable only from devices that meet your standard
- Multi-factor authentication on every account, without exceptions
- Unusual sign-ins challenged automatically rather than noticed later
- A lost laptop wiped remotely and the account secured in minutes
- Leavers cut off everywhere at once, wherever their device is
Sign-in simulator
Example conditional access policy
Who
Where
Device
- Identity & MFA Windows Hello on a managed laptop counts as MFA Verified
- Managed device Enrolled, encrypted and up to date Compliant
- Location & risk Home broadband, usual country, usual hours Low risk
- App sensitivity Email, Teams and SharePoint for their team Permitted
Outcome
Allowed
Right person, healthy company laptop, normal sign-in: straight in, nothing extra to type.
The example policy
Typical starting rules. Every business gets its own version, set around how its people actually work.
- 1Everyone uses MFA. Windows Hello on a managed laptop counts.
- 2Admin roles: strong MFA every time, a managed device and usual countries only.
- 3Devices you do not manage get the browser only, with downloads off.
- 4A new country asks for MFA again. Paired with an unknown device, it is blocked.
- 5Contractors reach the project site their role needs, and nothing else.
We set rules like these up in Microsoft Entra and Intune, and try them with your people before they are switched on.
Illustration of an example policy, not a universal rule. Pick a combination to try it.
A new starter, working remotely
From order to working, without a site visit.
-
Device ordered
Registered to your tenant by the supplier and shipped directly to the person, sealed.
-
Account prepared
Identity, licence, group membership and access created from the role, before the first day.
-
First sign-in
The laptop configures itself: policies, applications, encryption and protection all applied automatically.
-
Working
Mail, files and Teams ready, with a short call to make sure it all landed properly.
Why CaminhoIT
Security people do not have to co-operate with.
Controls that get in the way get worked around, and a workaround is worse than the risk it was meant to remove. We aim for arrangements people never really notice — which takes more care to configure, and far less effort to live with.
- Invisible when it should bechallenges only when warranted
- Zero-touch setupno imaging, no site visit
- Country-agnosticPortugal, the UK, elsewhere
- Bilingual helpdeskEnglish and Portuguese
- Clean offboardingeven at a distance
- Requests in one placethrough your client portal
Questions
Remote and hybrid working questions
Can staff use their own laptops?
They can, but it changes what you are able to guarantee. On a personal device you cannot enforce encryption or patching, you cannot prove the machine is healthy, and you cannot remove company data cleanly when someone leaves. Where personal devices have to be supported — contractors, for instance — we normally restrict them to browser access with no local copies, which keeps the data inside the tenant.
Do we still need a VPN?
Only for systems that genuinely sit on your own network — an on-premise server or a line-of-business application. Microsoft 365 needs no VPN, and routing that traffic through one usually makes things slower for no security benefit. Where remote access is still required, we scope it to the specific systems rather than handing out access to the whole network.
What happens if someone loses a laptop?
Report it and we secure the account first, which matters more than the hardware. Managed devices are encrypted, so the data is not readable without the sign-in, and we can issue a remote wipe that runs the moment the device next connects. A replacement can be shipped and self-configured wherever the person is, normally without an office visit.
Our team is spread across Portugal, the UK and elsewhere. Is that a problem?
It is normal for our clients, and cloud-based device management makes it straightforward: a laptop enrols itself wherever it is. What needs local planning is procurement, warranty cover and on-site attendance if something physical fails — and any data-location obligations you have, which we confirm rather than assume.
Will MFA annoy everyone?
Configured badly, yes. Configured well, most people are prompted rarely — sign-ins from a known, healthy device in the usual place can be trusted for a period, with challenges reserved for genuinely unusual circumstances. Number matching in the Authenticator app takes seconds. The complaints we hear about MFA are almost always about how it was set up rather than about MFA itself.
How do you support people you cannot visit?
Managed devices can be reached remotely with the user's consent, so the helpdesk sees the screen and fixes the problem live. Monitoring catches many faults — a failing disk, a device that has stopped updating — before anyone reports them. Where hardware genuinely fails, we ship a replacement that configures itself on first sign-in.
Not sure how well your remote setup holds up? Run the IT Health Check →
Ready to get started?
Make hybrid working something you can prove is safe.
We will look at how your devices and identities are managed today and tell you what would need to change.