Multiple Locations IT Support: How an In-House Team Runs Every Site Without Living on the Road

Updated: November 2026. Windows, Intune and Entra settings checked against Microsoft Learn, and out-of-band guidance against CISA, on 11 November 2026.

Every extra office, store or clinic adds a network, a closet and a queue of tickets, and the IT team can't stand in all of them at once. The way out is to decide what runs remotely, what a trained local contact handles and what still earns a drive, then build each site so the drives get rarer. This guide to multiple locations IT support for in-house teams covers that split, standard site builds, branch networks, ticket routing and a one-page card for every site.

TL;DR

• What it is. One IT team runs devices, networks and support for two or more sites, remotely by default, with local help.
• The split. Sort each task into remote, local hands or a visit, and make each visit remote next time.
• Same build everywhere. One device build, one kit list, one VLAN map and an IP plan keyed to site number.
• Branch links. Use Delivery Optimization Group mode, business-hours bandwidth caps and a second WAN link.
• Paperwork. Route tickets by site and keep a one-page card for each location.

What Multiple Locations IT Support Means

Multiple locations IT support is one IT team running the devices, networks and help desk for two or more physical sites, such as offices, branches, stores or clinics. The team works remotely by default, keeps the same standard at every site, and relies on a named local contact for jobs that need hands on the hardware.

People working from home are a different job, and our guide to supporting remote workers covers them. This post is about places with a closet, a firewall and a front door.

MSPs hit the same problems from the other side of the contract. LNC Data, a three-person MSP, looks after 81 dental offices, and its story sits in our guide to AI agents for operations.

Remote, Local Hands or a Site Visit

Every site ticket ends one of three ways: fixed from head office, fixed by someone already there, or fixed by someone who drove over. The table below is an example split, so adjust it to your sites. Watch the third column, because it names what turns a trip into a remote fix.

Then add one rule. Every task that needs a trip today gets a follow-up question: what would make this remote next time? The answer is often a switchable outlet, a spare on the shelf or a console cable left plugged in.

Here's what a branch looks like once those answers pile up.

Manage Every Device From One Place

Remote by default only works when every device at every site reports to one console. That's the device half of IT infrastructure management.

Put an RMM agent on every endpoint at every site, including the front desk PC nobody remembers buying. Without it, a branch is a black box until someone calls.

Pair the agent with unattended remote access, so a frozen PC gets fixed without anyone sitting next to it.

Intune shops can read our Intune Remote Help guide for Microsoft's own option.

OpenFrame is open, AI-native infrastructure for IT and security. Fae resolves support requests and Mingo runs IT operations, covering large areas of RMM, remote access and patching, so devices at every site report to one place. It costs $1 per device per month, with a 14-day free trial. Flamingo builds OpenFrame, so read this mention with that in mind.

Patching Over Thin Branch Links

Monthly updates are where small branch links hurt. Windows has a built-in fix, Delivery Optimization, which lets PCs share update content. Its default mode, LAN (1), shares only between peers behind the same public IP. Group (2) shares across internal subnets within a group, remote offices included, and Microsoft recommends Group mode for bandwidth.

The group decides whether branches work. DOGroupIDSource takes it from the AD site, domain SID, DHCP option 234, DNS suffix or Entra tenant ID. With nothing set, Windows tries AD site, then domain SID, then Entra tenant ID. A cloud-only fleet has no AD site or domain, so expect it to land in one tenant-wide group. Give each site its own DHCP option 234 value or DNS suffix to keep peering inside the site. If that lookup fails, Windows falls back to the default order, so test it at one site first.

Then cap background downloads. On low-bandwidth links, Microsoft recommends an absolute limit in KB/s, DOMaxBackgroundDownloadBandwidth, over percentage caps. DOSetHoursToLimitBackgroundDownloadBandwidth then sets what share of that limit Windows may use during and outside business hours. Fold both into your Windows patch management rings.

A site with a weak link can add Microsoft Connected Cache for Enterprise and Education, a software-only cache for Microsoft content. It's been generally available since 23 July 2025 and is free with Windows Enterprise E3, E5 or F3 or Education A3 or A5 licenses. Microsoft's branch profile is 10 to 50 Windows devices, no server hardware and limited internet, and there it runs on a Windows 11 PC. It caches Windows updates, Microsoft 365 Apps, Intune apps and Defender definitions, and devices fall back to Microsoft's CDN if it's down. Point devices at it with DOCacheHost or DHCP option 235.

Microsoft's Windows At Work channel shows how Connected Cache works, how to deploy it to host machines remotely and how to troubleshoot it. It was published in March 2025, while the product was still in preview, so setup screens may differ today.

WSUS isn't the branch answer for new builds: Microsoft announced its deprecation on 20 September 2024, and it gets no new features. Then check each site in your patch compliance reports, so a branch that's quietly behind shows up.

Night patching needs PCs that are on, and waking one at a branch means crossing subnets. Our Wake-on-LAN guide covers the options.

A Site With Its Own IT Person

A larger site may have its own IT person. In Intune, a role sets what an admin can do, and a scope tag sets which devices and policies they see. Microsoft's own example is a Seattle regional office admin who manages only Seattle's devices and policies. Autopilot device records don't support scope tags, so keep Autopilot registration central.

One Standard Build for Every Site

Each site built its own way is one more set of quirks to remember at 7am. A written standard makes every site a copy of the last, and copies are easy to fix remotely.

Windows Autopilot lets the vendor register a laptop to your tenant and ship it straight to the site, where it sets itself up at first sign-in.

Where Autopilot doesn't fit, a disk imaging workflow gets each PC to the same known state.

For the site kit, pick one firewall, one switch and one access point model. Use one VLAN map everywhere, so VLAN 20 means the same thing at every site.

Key the IP plan to the site number. In this example, site 12 uses 10.12.0.0/16 and its user VLAN is 10.12.20.0/24. Change the numbers to suit your network. This scheme stays inside 10.0.0.0/8, private space under RFC 1918, and no two sites overlap. Overlapping subnets break site-to-site links later.

Put the site code in every name, like SITE12-FW01, so a device name in a ticket tells you where it lives. Keep a spare shelf at larger sites: an access point, a small switch, power bricks, patch cables and toner.

Local Hands at Every Site

Every site needs one named person who can be IT's hands for five minutes, plus a backup. Pick someone who's in every day, like an office manager or a shift lead. Write down what they may do and what they never do:

• Power cycle a labeled device when IT asks.
• Swap a part from the spare shelf.
• Read status lights out on a call.
• Let a vendor or ISP technician in.
• Receive shipments and plug in ready devices.
• Never change a configuration, even when a vendor asks.
• Never share admin credentials.

Train them once, on a video call with the camera pointed at the closet. Label every device with its name and job, and put a photo in the site card. An unlabeled closet turns a quick power cycle into a guessing game.

A solo IT admin who works fully remote asked r/sysadmin how to handle on-site needs. Replies suggest naming in-office staff as IT's remote hands, since contracted field services rarely arrive the same day. They also suggest putting routers, firewalls and switches on power you can cycle remotely.

A site that outgrows its local contact can get a field technician or a local MSP, paid per incident or on retainer. Our guide to co-managed IT covers how to split that work.

If the queue itself is the bottleneck, outsourcing the help desk is a separate decision.

The Site Network

A site-to-site IPsec tunnel back to head office is the classic way to link a site. It behaves well with a firewall at each end and a fixed public address.

SD-WAN is the other route, and our SD-WAN guide compares it with MPLS and VPN.

Give each site a second internet link from a different provider, with automatic failover on the firewall. A circuit outage then becomes a ticket to the ISP instead of a closed branch.

When the firewall hangs, the remote tools go with it. In December 2024, CISA, the NSA, the FBI and partner agencies published Enhanced Visibility and Hardening Guidance for Communications Infrastructure. Written for telecom networks, it recommends an out-of-band management network, physically separate from the data network. A branch can scale that down to a cellular console or a separate management path to the firewall and core switch.

Identity and Domain Controllers

Identity travels better than IP rules. Conditional Access named locations match the public IP a site uses to reach the internet, not its internal addresses. A named location built on a branch's dynamic ISP address stops matching when the ISP changes that address. Behind a cloud proxy or VPN, Microsoft says requiring a compliant or hybrid-joined device is easier than keeping IP lists current.

A branch domain controller earns its place only where a site still depends on on-premises AD for sign-in or apps. List what a site must still do with its link down for a day: sign in, open files, run core apps, print. Test that at one pilot branch before you add branch domain controllers.

An IT support tech at an insurer with 80+ branches, mixed routers and dynamic IPs asked r/sysadmin whether AD plus site-to-site IPsec was the right plan. Replies push toward cloud identity and device management instead of tunnels and warn against sending all traffic through head office. They also recommend an equipment standard, two links per branch and that link-down test.

Help Desk Routing by Site

A central help desk works when every ticket says where it came from. Make the site a required field, filled from the device or user record so nobody types it.

Write site hours and time zones into your service level agreement, so a 5pm ticket three time zones away doesn't breach overnight.

Any IT ticketing software with custom fields and routing rules can run a dispatch queue.

If the help desk itself is new, start with our help desk basics.

The Site Card

A site card is one page with everything a technician needs to fix a site from head office. When the circuit drops at 8am, nobody should dig through email for the circuit ID.

Keep it in your documentation tool, linked from the site record in the help desk.

A card goes stale the first time someone swaps a switch and forgets it. Make the update a step in a written standard operating procedure.

Adding a New Site

Openings and acquisitions follow the same checklist, though an acquisition starts with an inventory of what's there. Start early, because the ISP order is the slow part.

1. Assign the site number, code and IP range.
2. Order both internet links and ask for lead times.
3. Order the standard kit and configure it at head office.
4. Set up out-of-band access to the firewall and core switch.
5. Set the site's Delivery Optimization group and decide on a Connected Cache node.
6. Order devices through Autopilot, shipped to the site.
7. Name and train the local contact and a backup.
8. Fill in the site card, closet photos included.
9. Add the site to the help desk with hours and contact.
10. Run a first-week check: failover, remote sessions, patch status and a test ticket.

The Short Version

Multiple locations IT support works when the central team decides ahead of time what runs remotely, what the local contact handles and what needs a visit. Build every site from the same kit and IP plan, patch over thin links with Delivery Optimization groups, and route tickets by site. A card for each site means every fix starts with facts. Next, see how IT department structure changes as the company grows.