IT for multi-site businesses: keeping depots, branches and offices on one network

Businesses with more than one location, whether that means a head office and three depots, a chain of branches, or two offices and a warehouse, have an IT problem that single-site businesses never meet: making every site work like part of the same company. This guide explains how it is done, what each site needs, and where multi-site businesses most often go wrong.

What "one network" actually means

Staff at any site should log in with the same account, reach the same files and systems, make and receive calls on the same phone system, and be protected and supported the same way. Behind that are five layers:

1. Identity. One directory (usually Microsoft 365) so a user exists once and their access is managed centrally.
2. Connectivity. Each site connected to the internet, and to the other sites where needed, with failover.
3. Local network. Firewall, switches and Wi-Fi at each site, managed from one console.
4. Applications and data. Cloud services where possible, and a VPN or SD-WAN to reach anything that still lives at a site.
5. Management and security. Every device at every site monitored, patched and protected the same way.

Our IT support for multi-site businesses page describes how we deliver this. The rest of this guide is about how to design it.

Identity first

The single most effective step in a multi-site business is moving to one identity. When every user exists once in Microsoft 365, joining a new site means adding it to the directory rather than building a separate one, and a leaver is removed once rather than once per site. Our Microsoft 365 services start here for exactly this reason.

Identity also fixes starters and leavers. A new depot manager gets one account that works at every site on day one, and a leaver loses access to email, files, the hire system and the phone system when that one account is disabled. In a business where staff move between sites, or where a branch is sold or closed, that single point of control is the difference between a tidy change and months of orphaned accounts.

With cloud identity in place, sites that run entirely on Microsoft 365 and cloud applications need only a good internet connection and a firewall. Sites that still need a server, a hire system, a stock system, cameras or shared printers at another site need the next layer.

Connecting sites: VPN, SD-WAN or cloud only

Most businesses of up to 250 people with several sites end up with cloud identity plus site-to-site VPNs between a firewall at each site and head office. That is the pattern we have run for more than 15 years for Mr Plant Hire, a plant and tool hire business headquartered in Enfield with multiple depots. Site-to-site VPNs connect each depot to head office, UniFi Wi-Fi covers the branches, SharePoint holds shared documents, and endpoint detection and remote management cover every machine wherever it sits. The Mr Plant Hire case study has the detail.

Connectivity at each site

Every location needs a primary connection sized for its staff and cloud usage, and a failover on a different technology. In practice:

• Head office: a leased line or full fibre with a service level, plus a 4G or 5G failover.
• Branches and depots: full fibre where available, otherwise the best fixed line the site can get, plus a 4G or 5G router with an external antenna. On industrial estates the 4G connection is sometimes faster than the fixed line.
• Temporary sites: 4G or 5G only, joined to the network by VPN, with the router documented so it comes back and goes to the next site.

Lead times matter. Leased lines can take months, and a new site should have its connectivity ordered as soon as the lease is signed. Our multi-site connectivity service is built around ordering early and monitoring everything.

Wi-Fi and the local network

Each site needs a firewall, managed switches and Wi-Fi that covers the working area, not only the office. A depot warehouse, a shop floor and a meeting room have different coverage problems and each deserves a survey.

The important design decision is a single management console. UniFi and Cisco Meraki both allow every access point, switch and gateway at every site to be configured and monitored from one place. That gives consistent network names, a separate guest network at every site, and an alert when an access point in a depot goes offline. It also ends the pattern where each site has a consumer router bought locally by whoever was there when the old one failed. Our office Wi-Fi service covers the survey and design.

Phones across sites

A multi-site business almost always benefits from one VoIP phone system. Calls transfer between sites free, a receptionist at head office answers overflow from a branch, and staff take calls on a mobile app when they are between sites. With the PSTN switch-off due by January 2027 according to Ofcom, branch analogue lines need replacing anyway, and consolidating at the same time is cheaper than replacing them one at a time. Our VoIP and business phone service covers the migration.

Security and management at every site

The security risk in a multi-site business is inconsistency. Head office is patched and monitored, and a depot PC has run unpatched for two years because nobody visits. Attackers find the weakest site and use the network to reach the rest.

The fix is central management: remote monitoring and management on every device so patching happens everywhere, endpoint detection and response on every machine including the depot hire desk, MFA on every account, and backups that include any server still sitting at a site. The NCSC's small business guide is the baseline, applied to every site rather than only the one the directors sit in.

Supporting sites you cannot reach in ten minutes

Remote support handles most tickets wherever the user is. For everything else:

• Hold spare routers, switches and access points centrally, pre-configured.
• Label and document every site's network so a local person can swap hardware under guidance.
• Agree with the provider how faults at distant sites are attended and how quickly.
• Monitor every site so the provider knows about a problem before the site rings.

The question to put to any provider is specific: a depot ninety minutes away loses its switch on a Monday morning, so what happens and how quickly is it trading again? A good answer involves a spare already configured, a named person at the depot who can plug it in under guidance, and an engineer on the road if that fails.

Common mistakes

• Opening a new site with whatever broadband and router was quickest, then trying to integrate it later.
• Running a separate Microsoft 365 tenant or local accounts at a site because it started as a separate business.
• Leaving a server at a site nobody visits, unpatched and backed up to a drive on the desk.
• Buying phones per site from different suppliers.
• Assuming the IT provider is monitoring the depots when the contract only covers head office.

What to do next

If your sites run on different routers, separate logins or phone systems from different suppliers, or if you are not sure which sites the IT provider actually monitors, an independent review will show where the gaps are. Book an IT health check and we will assess every location, prioritised by the cost of that site going offline.