Email security for remote teams: what to set up first

Remote and hybrid work changes where email security breaks. Staff sign in from home networks, cafes and personal phones, and they can't lean over to ask a colleague whether a strange request is real. The good news is that the controls that matter most are built into Microsoft 365 and Google Workspace. This guide covers what to set up first, with official guidance for each step.

What are the main email risks for remote teams?

Most risks come back to one thing: someone else signing in as your employee, or tricking them into acting.

• Stolen passwords. A phished or reused password is enough to read a mailbox from anywhere if nothing else is required.
• Old sign-in protocols. Microsoft notes that legacy authentication "doesn't support multifactor authentication," and that most compromising sign-in attempts come from it (Microsoft Learn).
• Unmanaged devices. A lost personal phone with work email and no screen lock is a data leak.
• Weak home equipment. Routers with default passwords or old firmware.
• Verification gaps. A fake "urgent payment" email is harder to check when the sender's office is 300 miles away.

Why is multifactor authentication the first control?

With MFA, a stolen password alone isn't enough. CISA says "users who enable MFA are significantly less likely to get hacked," and that while phishing-resistant MFA is the goal, "any MFA is better than no MFA" (CISA). Phishing-resistant methods, such as FIDO security keys and passkeys, can't be relayed through a fake sign-in page.

Microsoft 365. If you don't have Conditional Access, turn on security defaults. They require every user to register for MFA, require MFA for administrators, block legacy authentication protocols and block device code flow (Microsoft Learn). Microsoft removed the old 14-day MFA registration grace period in July 2024. Before you switch them on, check that no device or app still relies on basic authentication, such as an old scanner that sends email.

Google Workspace. Enforce 2-Step Verification for everyone. You can start enforcement immediately or on a set date, and give new employees an enrollment period of 1 day to 6 months. The "Only security key" method, which now accepts passkeys as well as security keys, limits users to phishing-resistant sign-in (Google Workspace Admin Help).

Start with admins and anyone who handles payments, then roll out to everyone.

What is conditional access, and does a small team need it?

Conditional access lets you set "if-then" rules for sign-ins. Microsoft describes its policies at their simplest as: "if a user wants to access a resource, then they must complete an action" (Microsoft Learn). Rules can use the user, IP location, device, app and sign-in risk, and can block access, require MFA, or require a compliant device or an app protection policy.

Sources: Microsoft Learn, Microsoft Learn, Google Workspace Admin Help.

In Microsoft 365, organizations that replace security defaults with Conditional Access policies must disable security defaults. If you move, Microsoft recommends keeping the same baseline: MFA for admins and all users, and legacy authentication blocked. Useful first rules for a remote team are requiring MFA everywhere and blocking countries you never work from.

How should you handle personal devices?

Many small teams read email on personal phones. That's workable if you set a minimum standard. NIST's telework guide recommends securing both organization-issued and personal (BYOD) devices based on the threats they face (NIST SP 800-46 Rev. 2). The UK NCSC's home working advice adds that devices are more likely to be lost or stolen when working remotely, so data should be encrypted at rest, and mobile device management should let you lock or wipe a device (NCSC).

Google Workspace has basic mobile management "turned on" by default, and lets admins wipe a user's account from a lost or stolen phone (Google Workspace Admin Help).

Microsoft 365 with Conditional Access can require an approved client app or an app protection policy, so work data stays inside managed apps on personal phones (Microsoft Learn).

Tell staff to report a lost device immediately. The NCSC advises encouraging people to report losses as soon as they can.

Do home networks put email at risk?

Less than many people think, for cloud email. Connections to Microsoft 365 and Google Workspace are encrypted, so the bigger risks are the device and the account. But a compromised router can redirect traffic or expose other devices on the network, so basic hygiene is worth sharing with staff.

CISA's home network advice includes (CISA):

• Change the router's administrator password from the default.
• Install firmware updates, or turn on automatic updates if the router supports them.
• Use the strongest wireless encryption available; CISA recommends WPA3 with AES.
• Keep computers and phones updated.

On public Wi-Fi, staff should stick to sites and apps they reach directly, not through links in messages, and use a phone hotspot if they're unsure about the network.

How do you verify requests when the team isn't in one place?

Remote work removes the easy check of asking in person. Attackers know this. The NCSC recommends that important email requests are "verified using a second type of communication," such as a phone call (NCSC).

Agree on simple rules:

1. Payment or bank detail changes are confirmed by calling a number you already have, never one in the email.
2. Password resets and sign-in codes are never shared with anyone, including "IT".
3. Urgent requests from executives are confirmed in your team chat or by phone before anyone acts.
4. New tools or file links come through your normal channels, not a surprise email.

Our guides on business email compromise and vendor invoice fraud cover the scams these rules stop.

How do you onboard and offboard remote staff safely?

Remote teams often change faster than office teams, with contractors and part-timers coming and going. Accounts that outlive the person who used them are an easy target, because nobody notices odd activity.

When someone joins:

• Create their account with MFA enforcement already applied, and walk them through registration on a video call.
• Give admin rights only to those who need them, and use separate admin accounts for admin work. Microsoft recommends separate accounts for administration and everyday tasks (Microsoft Learn).
• Share your verification and reporting rules in the first week.

When someone leaves:

• Disable sign-in on their last day, and sign them out of active sessions.
• Remove their work account from personal phones through mobile management.
• Convert the mailbox to a shared mailbox or set up forwarding only if there's a business need, and review any forwarding rules they created.
• Review who still has access to shared mailboxes every few months.

Joint guidance from CISA and international partners lists disabling accounts for departing staff and removing unused accounts among its priority actions (CISA and partners).

What should remote staff do with a suspicious email?

Give them one clear route: the Report button in Outlook or Gmail, or one internal address. Make it clear that reporting a click is welcome, and that a fast report lets you reset a password in time. If someone has already clicked, follow what to do after clicking a phishing link, and watch for the signs of a compromised account.

Remote team email security checklist

1. MFA enforced for every mailbox, admins first; phishing-resistant methods for admins where possible.
2. Legacy authentication blocked.
3. Device minimums written down and applied, including personal phones.
4. Lost-device reporting route known to everyone.
5. Home router guidance sent to staff.
6. Verification rules for payments and passwords agreed and practiced.
7. One reporting route for suspicious mail.
8. Inbound filtering reviewed so less phishing reaches inboxes. See our small business email security checklist.

Next steps

1. Check whether MFA and legacy-authentication blocking are on for every account today, starting with admins.
2. Run the Email Health Check on your domain to confirm SPF, DKIM and DMARC are in place.
3. Reduce what reaches remote inboxes. A filtering layer in front of Microsoft 365 or Google Workspace, such as iBlockSpam, gives each user a personal quarantine with digests they can check from anywhere.

More operational guides are in our email operations topic.