The right mix depends on the software people cannot work without. Field sales reps who spend the day in Outlook and quotes want something quite unlike a bookkeeping team whose BMD installation sits on a box in the server cupboard.
Either an encrypted tunnel into the corporate network, or per-application access built on Zero Trust principles. Whichever you choose, the connection is accepted solely from an up-to-date company device signed in with an active account; knowing a password on its own gets nobody anywhere.
Azure Virtual Desktop or a classic terminal server keeps the whole session in the data centre, so the notebook on the dining table only draws what it is sent. Documents stay on the server, even if someone forgets the machine in a Railjet somewhere between Salzburg and Vienna.
BMD, RZL, construction tendering tools or a heavyweight CAD package run without lag once they are hosted centrally, since just the changing image travels while the database stays put. Nobody needs to carry the year-end accounts home on a USB stick.
Microsoft Authenticator provides the extra factor, while Entra ID policies turn away sign-ins from unfamiliar hardware or from parts of the world where none of your staff are based. Credentials stolen through a fake login page are useless by themselves.
Laptops and phones are enrolled in Intune, disks are encrypted with BitLocker and lost devices can be erased remotely. As a by-product, Intune knows which device belongs to whom, handy when listing the digital work equipment in a telework agreement. On departure, account, VPN and mailbox are shut in a single step.
Your company sets the rules, together with the works council where there is one. We configure the tools to match: Teams notifications muted after hours, Outlook scheduling that holds a late-night message until eight the next morning, and one-click login to your timesheet app so that recording hours remotely causes no extra friction.
Three common approaches. Choose by the sensitivity of your information and by where your software is installed; the number of home-office days per week hardly matters.
Approach 1
Managed notebook and tunnel
Each person is issued a company machine that dials into the internal network over an encrypted link.
Approach 2
Hosted sessions
Programs and files remain in the data centre; only pixels reach the home office.
Approach 3
Cloud only with Microsoft 365
Mail, documents and teamwork all live online, with no connection into the office LAN.
The most common hole remains remote desktop published directly to the internet. Automated scanners find an exposed RDP service within hours; guessing attacks on passwords start soon after, and all too often the story ends with ransomware. CERT.at has warned about this entry point for years. Should your staff log in from home like this, shutting that door is job number one, well ahead of hosted desktops or paperwork.
It can be done safely if the private machine never touches company files directly: a hosted desktop, or Microsoft 365 opened in a browser under a policy that forbids downloading. Plugging an unknown home PC into the internal network by VPN is a different story, because nobody can vouch for its contents. Legally, where the employer does not hand over the digital equipment, a suitable reimbursement for using the employee's own is normally part of the deal. An employment lawyer or the WKO can confirm what applies to you.
Everything technical. Apply supplies the inventory of hardware and programs provided by the firm, the approved ways of connecting, the storage locations for documents, and the procedure after a notebook is lost, including who gets told. Reimbursement, the permitted share of telework, working-time arrangements and accident cover belong to HR, legal counsel and any works council. Our section drops into your draft unchanged.
Across a basic VPN talking directly to the database, most likely yes. Programs built on the client-server pattern hate delay, and losing the link halfway through saving can damage records. Hosting the program centrally and streaming just the display avoids both problems, and the result feels much like sitting at your desk, even over an ordinary home connection.
Apply retains authentication logs, meaning a record of who accessed which system at what time, as any sound security set-up would. We do not deploy tools that capture screens or keystrokes. Austrian law puts firm limits on monitoring that affects human dignity, often requiring the works council's or the individual's approval, and GDPR applies as well. Ask your lawyer. Besides, spying on staff tends to destroy far more goodwill than it is worth.
The obligation sits with you as employer, and the choice of tool is made with your payroll provider. Apply makes sure it runs without friction away from the office: the usual Microsoft or Google login, the app pushed to every phone and notebook, and access limited so team leads view only their direct reports. Anything that needs several clicks and a separate password tends to be skipped.
That varies with the number of people, devices and programs, so we inspect things remotely first and then commit to a schedule. Effort is charged at €110 per hour plus VAT, or it forms part of a monthly plan. Hosted desktops get their own quote, since the biggest expense is reserving enough capacity for peak concurrent use.
Tell us how many people work outside the office and which applications they cannot do without. We will suggest the model that fits your data and circumstances.
Your enquiry has arrived
Our reply reaches you within one working day. Outages that leave your staff unable to work are dealt with first.
We could not find that town. Try another spelling, or choose whichever provincial capital lies closest; as everything is handled remotely, you get the same service in all nine Austrian states.
