What Is a VPN and How Does It Work?

A VPN, or Virtual Private Network, creates an encrypted tunnel between a user’s device and a central network — usually the office or a data centre. When someone connects via VPN, their traffic routes through that tunnel, making it appear as though they are sitting inside the office network.

This approach made a lot of sense when most business applications lived on servers in the building. Staff working from home needed a way to reach those servers securely, and a VPN provided exactly that.

The problem is that most businesses no longer work that way.

If your team uses Microsoft 365, they are accessing email, files, and Teams through the internet, not through a server in your office. Routing that traffic through a VPN adds delay and complexity without adding meaningful security. The application already handles its own authentication and encryption.

The Limitations of a Traditional VPN

There are a few specific ways that VPNs start to show their age in a modern business environment.

Access is all or nothing. When a user connects to a VPN, they typically gain access to the whole network, not just the application they need. If that account is compromised, the attacker has the same broad access. This is sometimes called the “castle and moat” problem: once someone is past the gate, they can move freely inside.

VPNs do not verify the device. A traditional VPN checks credentials but rarely checks whether the connecting device is managed, up to date, or compliant with company policy. An unmanaged personal laptop can connect just as easily as a company-issued device.

Performance suffers under load. When a large portion of the team connects simultaneously, VPN infrastructure can become a bottleneck. This became a significant issue for many businesses during the shift to remote working.

Maintenance adds overhead. VPN infrastructure requires licences, configuration, patching, and monitoring. For small businesses without a dedicated IT team, this is rarely handled as well as it should be.

What Is Modern Secure Access?

Modern secure access covers a range of approaches that move away from the network-centric model of a VPN and towards an identity-centric model. The most widely discussed framework is Zero Trust Network Access, often abbreviated as ZTNA.

The core principle is straightforward: do not trust any user or device by default, regardless of where the connection comes from. Instead, verify identity, check the health of the device, and grant access only to the specific application or resource the user needs, nothing more.

How Zero Trust Network Access Works

Rather than connecting a user to a network, ZTNA connects a user to an application. The distinction matters.

When someone attempts to access a business application under a ZTNA model, the system checks several things before granting access: who is the user, is their identity verified with multi-factor authentication, what device are they using, is that device compliant with company policy, and is this access request consistent with normal behaviour for this user?

Only once those checks pass does the user gain access — and only to the specific resource they requested, not the whole network.

This approach significantly reduces the blast radius if an account is compromised. An attacker with stolen credentials cannot move laterally through a network they never had access to in the first place.

VPN vs Modern Secure Access: A Direct Comparison

What Does This Mean for Microsoft 365 Users?

If your business uses Microsoft 365, you may already have access to tools that replace or significantly reduce the need for a traditional VPN, depending on your licence.

Microsoft Entra ID (formerly Azure Active Directory) handles identity and conditional access. You can set policies that require MFA, check whether a device is compliant, and block access from unrecognised locations — all without a VPN in the picture.

Microsoft Intune manages devices. It can verify that a laptop or mobile phone meets your security requirements before allowing access to company data.

Microsoft Entra Private Access (available in Microsoft 365 E5 and some add-on bundles) provides ZTNA-style access to on-premises applications. A direct replacement for VPN in many scenarios.

Business Premium gives you the foundation: Entra ID P1 and Intune are both included. Microsoft 365 E5 takes this further with Defender for Identity, advanced conditional access, and Entra Private Access.

If you are still running a VPN alongside Microsoft 365, it is worth asking what the VPN is actually protecting at this point — and whether those tools are doing the job more effectively.

Do Small Businesses Still Need a VPN?

The honest answer is: it depends on your setup.

If your business runs applications on a local server (an on-premises accounting system, a legacy database, or specialist software that cannot move to the cloud) then some form of secure remote access to that server is still necessary. A VPN can cover that gap, or a ZTNA solution with private access capability can handle it more precisely.

If your business is fully cloud-based (Microsoft 365, cloud accounting, a CRM accessed via browser) then a VPN is likely adding friction without adding protection. The tools built into your Microsoft 365 licence are doing a better job of securing access than a VPN ever could.

The question to ask is not “do we have a VPN?” but “what is our VPN protecting, and is it still the right tool for that job?”

How to Review Your Current Setup

Reviewing your secure access setup does not need to be a large project. A few simple questions will tell you a lot.

What applications do your remote workers actually need access to? If the answer is entirely cloud-based, a VPN is probably unnecessary.

Is multi-factor authentication enforced for all staff? If not, this is the first thing to address, regardless of whether you use a VPN or a modern alternative.

Are your devices managed? If laptops and phones can connect to company systems without any check on their health or compliance status, that is a risk worth addressing. Intune can resolve this if you are on Business Premium or above.

Do you know what licence your Microsoft 365 subscription includes? If you are unsure, it is worth checking — the tools you need may already be available to you.

The Bottom Line

VPNs were the right answer for a different era of business IT. They were built for a world where applications lived on local servers and remote access was the exception rather than the rule.

Modern secure access, built around identity verification, device compliance, and application-level access rather than network-level access, is a better fit for how businesses actually operate today.

For most small businesses using Microsoft 365, the shift away from VPN is not a large change. It is largely a case of using the tools already available in your licence more effectively.

If you would like to understand what your current Microsoft 365 licence includes and whether your remote access setup is still appropriate, the Via Wire team is happy to help.

Get in touch at viawire.net/contact or call 01702 668730.