The digital workplace: more than a laptop with Teams

What a digital workplace is, and what it is not

The term is used so broadly it has almost stopped meaning anything. In practical terms a digital workplace is the whole of three things, and the trick is to look at them separately.

• The identity. The account someone signs in with, what they are allowed to do with it, and how you know it is really them. This is the layer that decides whether the rest is safe.
• The device. The laptop, the phone or the thin client: whose is it, who manages it, and what happens when it is left on a train.
• The applications and the files. Where they sit, how someone reaches them, and whether that also works when they are not in the office.

What it is not: a laptop with Microsoft 365 on it. That is one layer of the three, and it is the layer that least determines whether the whole thing works. So the question "do we have a digital workplace" cannot be answered yes or no. The question that does produce something is: which of these three did we set up deliberately, and which one simply grew.

The four shapes, and when each fits

There are roughly four ways to build this. They are not mutually exclusive — most organisations run two side by side — but they ask for different things.

• Own device, managed from the cloud. The laptop belongs to the company, the work sits on it, and management happens remotely without it ever needing to come into the office. This fits by far the most office organisations and is usually the calmest answer.
• Virtual desktop. The desktop runs in a data centre and the device is only a screen. Fits where data may not leave the data centre, where heavy applications need to sit close to the data, or where many people on shifts do the same work.
• Everything in the browser. No installed applications any more, only web services. Cheap to manage and limited in what it can carry; it stands or falls on the one application that cannot.
• Mixed. The office people on the first model, production or the front desk on the second. This is the most common in practice and it is rarely chosen deliberately.

What decides it in nine cases out of ten is not the price but one application: the one that only runs locally, or only on Windows, or only when it sits next to its database. Start there, not with a comparison of licensing models.

The login has become the perimeter

When everyone sat in the office, the network was the boundary: inside was trusted, outside was not. That model did not break, it simply became irrelevant. If the work is in the cloud and the people are everywhere, there is no inside left.

What then still stands between an attacker and your files is the account. That changes where your attention has to go:

• A second factor on everything, including the admin accounts. Especially the admin accounts, because those are worth the trouble.
• Conditional access. Not only who signs in, but from which device and in what circumstances. A sign-in from an unmanaged device should not be allowed to do the same as one from a laptop you issued yourself.
• Leavers. This is the layer where it goes wrong in practice. An account that stays alive is an open door, and with a digital workplace that door can be reached from outside.

A VPN solves none of this. It moves the problem to a login that is itself also an account. How we set this up sits under cybersecurity.

What breaks in practice

Four things, and they are rarely the things in the quote.

• Printing. This is not a joke. With every workplace change, printing is the first thing anyone notices and the last thing that works, and it costs more discussion than the rest combined.
• That one application. There is always one: the package from a supplier that no longer exists, the macro the whole planning runs on, the machine that only speaks over a serial port. Find it before you start, not after.
• The connection at home. A virtual desktop over a mediocre line is worse than no digital workplace. Measure this before you promise it.
• The moment someone leaves. They go, the account stays, the laptop sits in a drawer. That is not a technical problem but a process problem, and it is one you only have to set up once.

We walk through those four before anything changes, because all four are cheap to solve in advance and expensive to meet afterwards.

How to introduce it without stopping the business

The biggest mistake is treating it as a project with a date on which everyone is switched over. That does not work, because the exceptions do not sit with the first hundred people but with the last ten.

What does work is a sequence. Identity first, because the rest hangs off it. Then one representative group — not the board and not the IT department, but the department with the most friction. After that the rest in groups, with room between each group to change something.

And keep one thing for the end: the exceptions that do not fit. You do not solve those by forcing them, but by naming them and keeping them apart. An organisation with five machines that only talk to an old Windows version does not have a failed project; it has five machines that are managed separately and a list saying why.

What remains as maintenance after that — updates, new joiners, devices due for replacement — sits under managed IT.