Background
This construction company runs Microsoft 365 alongside internal systems. More than three hundred devices sit with staff in the field—remote and hybrid, not all in one building.
The file layout was already reasonable. What was missing was comfort for the people using it every day, and a way for IT to see what was actually out there.
Business Challenge
Construction bids bring in a lot of documents. Those files get misplaced, moved, or deleted. Without a backup layer on O365, getting them back was hard or impossible.
The old VPN client only worked when someone remembered to start it. People forgot a lot. Dataforge did not always hear about every incident—users notice a disconnected drive pretty quickly—but the frustration was constant. A P: drive with an X through it is a real problem when that is how you reach shared files.
There was no RMM. Nobody really knew what was patched or what hardware and software sat in the field. Security needed tightening. The question was not only whether things worked—it was whether the setup was easy and comfortable for users.
Solution
Dataforge backed up Microsoft 365 so bid files and other O365 data could be recovered when something was deleted or moved by mistake.
O365 backup, Dataforge Remote Management, and Sophos Complete with Managed Detection and Response went on together. That gave inventory, patching, remote support, and 24/7 endpoint coverage with a managed security team.
Disk encryption came next, to protect WireGuard credentials if a laptop was lost or stolen. Always-on WireGuard replaced the old VPN client last. Users open the laptop and work. They should not have to think about the tunnel.
Implementation
The rollout ran device by device over about a month. O365 backup, RMM, and Sophos went on in one pass. Encryption followed. WireGuard came last, once the disks were protected.
Today we can see what we need through the tools—including where a device is, which helps when we are diagnosing a problem. Issues get looked at in a few minutes. Most repairs finish in fifteen to thirty minutes.
Project Considerations
Three hundred devices do not change over in a weekend. Going device by device matched how people actually work across sites and schedules.
Encryption before WireGuard was deliberate. An always-on VPN is only as safe as the laptop holding the credentials.
A VPN people keep forgetting to start is a design problem, not a training problem. We wanted something users would not have to think about.
Environment Comparison
| Previous Environment | Current Environment |
|---|---|
| P: drive with an X when users forgot to connect the VPN client | Always-on WireGuard; users do not notice the tunnel |
| Construction bid files misplaced, moved, or deleted with no way to get them back | O365 backup for files that get lost in day-to-day work |
| No RMM; patch and software status unknown across 300+ devices | Inventory, location, and patch visibility; helpdesk looks at issues in minutes |
| Security needed hardening on field laptops | Disk encryption before WireGuard, plus Sophos Complete MDR |
| VPN and internal access frustrated users every week | Always-on access designed so users do not have to think about it |
Key Outcomes
- VPN users do not notice — always-on WireGuard replaced a client people kept forgetting to start
- Bid files recoverable — O365 backup for documents that get moved or deleted in construction work
- 15–30 minute repairs — issues looked at in a few minutes with RMM, including device location
- About a month to full coverage — O365, RMM, and Sophos together, then encryption, then WireGuard—device by device
Long-Term Track Record
With always-on WireGuard, access is much cleaner. Users do not notice the VPN. That is the point.
Bid files and other O365 data can be recovered when something is deleted or moved. The fleet is inventoried, patched, encrypted, and under Sophos MDR. When someone needs help, Dataforge can see what is on the machine—and where it is.