Architecture · Network Architecture
Remote Workforce Architecture
A design that supports work from anywhere without extending implicit network trust to every home and hotel network.
IntermediateUpdated 2026-09-01
Overview
The target pattern removes the assumption that corporate access requires a corporate network. Devices are managed over the internet, applications are published through brokers or SSO, and access decisions depend on identity and device posture rather than location.
VPN remains for genuinely network level needs, scoped narrowly to the systems that require it, with per group policy rather than full network reach.
Layer model
Access
SSO with phishing resistant MFADevice compliance requirementZTNA or application proxy for internal appsScoped VPN for legacy needs
Device
Cloud enrolment and configurationDisk encryption and EDRUpdate rings and patch complianceRemote support tooling with consent and logging
Data
Managed application boundariesSensitivity labels and DLPControlled external sharingNo local only data of record
Experience
Split tunnelling for SaaS trafficSynthetic checks from user locationsSelf service password and MFA recoveryClear support paths
Design considerations
- Do not backhaul SaaS traffic through a central egress unless there is an inspection requirement that justifies the latency.
- Plan onboarding and offboarding when the device never touches an office.
- Provide recovery paths that do not require corporate network access, including disk encryption recovery and MFA reset.
Security considerations
- Require compliant devices for data access; unmanaged devices get browser only, restricted sessions.
- Monitor for impossible travel and for concurrent sessions from divergent locations.
Failure points
- Identity provider outage
- Single VPN concentrator
- Support process that assumes physical access