Making Hybrid Work Reliable for Professional Services Firms

Identity as the foundation

In an office-only environment, physical presence did a lot of the security work implicitly, since being in the building at least meant being past the front door. Hybrid work removes that implicit check, which means identity, meaning who someone is and what they're allowed to access, has to do more of the work explicitly.

A centralized identity platform, most commonly built around Microsoft 365 or a similar directory service, lets a firm manage one login per staff member across email, file storage, and line-of-business applications, enforce MFA consistently regardless of location, and revoke access immediately and completely when someone leaves, rather than tracking down a dozen separate accounts.

Device management: company-owned and personal

Professional services firms vary widely in whether they issue laptops or allow staff to work from personal devices, and many run a mix of both. Whichever model a firm uses, some level of device management matters: company-owned laptops should be enrolled in a management platform that enforces encryption, patching, and remote wipe if lost, and personal devices accessing firm email or files should at minimum be covered by conditional access policies that require a PIN or biometric lock and block access from clearly non-compliant devices.

The goal isn't to control every personal device completely, which most staff would resist, but to make sure firm data isn't sitting unprotected on a device that could be lost, stolen, or shared with someone else in a household.

Secure file access without email attachments and personal cloud accounts

It's still common to see staff emailing client documents to their personal Gmail so they can work on them from home, or saving working files to a personal Dropbox for convenience. Both habits quietly move client data outside the firm's control and outside any backup or security policy the firm actually has in place.

The fix is making the sanctioned option genuinely as convenient as the workaround: proper remote access to firm file storage, whether through a cloud platform like SharePoint and OneDrive or a secure remote desktop setup, so working from home doesn't require exporting data to a personal account just to get the job done.

Realistic support expectations for a distributed team

Support that assumes everyone is in one office, with a technician walking over to a desk, doesn't translate cleanly to a hybrid team split across home offices and a physical location. Remote support tooling, clear channels for reporting issues, and response-time expectations that reflect a distributed workforce all need to be part of the support agreement, not assumed to work the same way they did before.

• Remote monitoring and support tools installed on every device, wherever it's located
• A single, clear channel for reporting IT issues, regardless of whether staff are home or in office
• Response time commitments that don't assume physical proximity to a technician
• Video-based troubleshooting for issues that would otherwise need an in-person look

A quick comparison: ad hoc hybrid setup vs. a designed one

Related reading

Real estate brokerages facing a similar challenge with agent-owned devices may find real estate brokerage IT support useful for comparison, and non-profits balancing staff and volunteer access across locations may find relevant ideas in stretching a non-profit IT budget.

Frequently asked questions