Glossary
VPN (virtual private network)
Also called: Virtual private network, remote-access VPN
In one sentence
An encrypted tunnel across the internet that lets a remote device connect to your office network as if it were plugged in at the office.
A VPN creates a private, encrypted connection between a device and a network over the public internet. Businesses have traditionally used VPNs so staff working from home could reach the office file server or a practice database that only runs on the office network. VPNs can also link two offices together.
VPNs are useful but not automatically safe. A VPN that accepts just a username and password is a common way into small businesses: attackers buy or guess passwords and log straight in. CISA and other agencies have repeatedly warned about attackers exploiting unpatched VPN devices. If you use one, it needs MFA, current firmware, and access limited to the people and systems that really need it.
Many small offices can reduce their reliance on VPNs. When email and files live in Microsoft 365, staff reach them securely from anywhere, and Conditional Access can check that the device is company-managed before letting it in. That’s the zero trust approach: verify each sign-in rather than trusting anything “inside” the network.
Example: an accounting firm still runs one tax application on an office server. Instead of giving every staff member a full VPN to the whole network, remote access is restricted to that one server, requires MFA, and only works from firm-managed laptops. Everything else lives in Microsoft 365. A note on consumer VPN apps: those advertised for privacy are a different product and don’t secure your business systems.
Related terms
- Encryption in transitProtecting data while it travels between devices or across the internet, so it can’t be read or altered on the way.
- MFA (multi-factor authentication)MFA means signing in with something you know (a password) plus something you have or are (a phone app, security key or fingerprint), so a stolen password alone isn't enough.
- Zero trustZero trust is a security approach that never assumes a user or device is safe just because it's inside the office network — every access request is verified based on identity, device health and context.
- FirewallA device or piece of software that controls what network traffic is allowed in and out, blocking connections that don’t match its rules.
- Conditional AccessConditional Access is the Microsoft Entra ID feature that decides, at every sign-in, whether to allow, block or require extra checks based on who is signing in, from what device, and from where.