Multi-site IT for UAE groups: standardising offices, warehouses and retail

The problem with growing site by site

Every new branch gets set up quickly by whoever is available: a local cabling contractor, a telecom salesman's router, consumer Wi-Fi from an electronics shop. Five years later the group has seven firewall brands, three backup tools, shared passwords at the outlets and no single list of what it owns. Support is slow because every site is different, and security questionnaires are hard to answer honestly.

Standardisation fixes that. It is not glamorous work and it does not happen in one project, but it is the single biggest lever on support cost and risk for a multi-site group.

Step 1: assess what you have

• Site list with users, devices, business function and opening hours.
• Internet links per site: provider, speed, contract end date, backup link or not.
• Network kit: firewall, switches, Wi-Fi, with model, age and support status.
• Local systems: POS, warehouse scanners, CCTV, access control, printers, servers in cupboards.
• Who supports each site today, under what contract.
• Legal entity per site, and which Microsoft 365 tenant and licences it uses.

Most groups find at least one site with an unsupported firewall, one with no backup link, and a set of devices nobody can account for.

Step 2: write a site standard in three sizes

	Office	Warehouse	Retail outlet
Internet	Two links, different providers where possible	Two links; check coverage across the yard	Main link plus 4G/5G backup
Firewall	Group standard model, centrally managed	Same	Smaller model, same family and policy
Wi-Fi	Business-grade, staff and guest separated	Industrial or high-ceiling access points, scanner roaming tested	Staff, POS and guest separated
Switching	Managed, VLANs per function	Managed, rated for the environment	Small managed switch
Devices	Intune-managed laptops	Rugged scanners and shared PCs, kiosk mode	POS terminals and one managed PC
Power	UPS for network and server	UPS; check heat and dust	UPS for router and POS

Buy network and radio equipment through authorised UAE channels: the Telecommunications and Digital Government Regulatory Authority (TDRA) requires type approval for telecom and wireless equipment used in the country. Our multi-site Wi-Fi design guide goes deeper on wireless.

Step 3: connect the sites

SD-WAN over two internet links per site is now the default for most UAE groups. Policies are set centrally, links fail over automatically, and cloud traffic goes straight out rather than back through head office. Keep the firewall family the same across sites so one policy and one console cover them all. Where a site runs a latency-sensitive system that still sits in a head office server room, plan to move it to the cloud or a private cloud, or size the links accordingly.

Step 4: one identity, one device standard, one security stack

• Identity: every user in Microsoft Entra ID with MFA. No shared logins at outlets; use shared-device modes or individual PINs.
• Devices: every company device in Intune, with the same compliance rules. See our Microsoft 365 security baseline.
• Security: one EDR, one email security policy, one firewall policy family, one monitoring view.
• Backup: one backup platform, including site servers that cannot move yet.
• Tenants: decide deliberately whether entities share one Microsoft 365 tenant or keep their own.

Step 5: one service desk and a clear support model

• One number, one portal, one email for every site.
• Remote management on every device so most issues are fixed without travel.
• Onsite visits scheduled per site size, plus dispatch for critical issues with travel times written into the SLA.
• A trained local contact at each larger site for first checks (is the router powered, which light is red).
• Monthly reporting by site and by entity, so cost can be charged back if needed.

Step 6: roll out in waves

1. Wave 0: head office and central services (identity, security, service desk, monitoring).
2. Wave 1: the riskiest sites: unsupported firewalls, no backup link, open Wi-Fi.
3. Wave 2+: remaining sites in line with contract end dates and hardware refresh.
4. New sites: built to the standard from day one, using a repeatable kit list.

Each wave has a cut-over plan, out-of-hours work for trading sites, and a way back if something fails. Retail and warehouses cannot close for IT, so plan around trading hours and peak seasons.

Group IT checklist

• Site inventory and a single asset and licence register.
• Written site standard in three sizes, approved by group IT and finance.
• Two internet links at every site that cannot trade without them.
• One firewall family, centrally managed; SD-WAN where it fits.
• Staff, POS, IoT/CCTV and guest networks separated everywhere.
• Every user in Entra ID with MFA; no shared outlet passwords.
• Every device in Intune; one EDR everywhere.
• One backup platform and monthly restore tests.
• One service desk with site-level SLAs and reporting.
• A rollout calendar tied to contract and refresh dates.

Where Missan helps

Multi-site and multi-entity groups are a large part of our work: we have delivered 10,000+ projects since 2004, including standardised firewall rollouts across multiple UAE sites and group IT for multi-entity companies. We survey, write the standard, run the rollout in waves with a way back, and support every site from one service desk. We cover all seven emirates from our head office in Sharjah, with teams in 3 countries. Fixed quotes after a site survey. See multi-entity group IT.

Related Missan services

• Multi-entity group IT
• Networks, cabling and CCTV
• IT infrastructure and systems integration
• Managed IT services
• Case study: multi-entity group IT
• Case study: multi-site firewall rollout

Frequently asked questions

Should every site have its own IT person?

Rarely. Most groups do better with a central service desk, remote management of every device, and onsite engineers scheduled or dispatched when needed. A large warehouse or a site with specialist systems may justify a local champion who is trained to handle first-line tasks.

SD-WAN or MPLS for UAE branches?

Most groups now use SD-WAN over two business internet links per site, from different providers where available. It is cheaper than MPLS, centrally managed and good enough for cloud applications. MPLS still makes sense for some latency-sensitive or regulated traffic. The decision depends on what runs where.

How do we standardise when every company in the group bought its own kit?

Do not rip everything out at once. Set the standard, apply it to every new site and every refresh, and replace the highest-risk items first: unsupported firewalls, unmanaged switches and consumer Wi-Fi. Most groups converge within two to three refresh cycles.

Can one Microsoft 365 tenant serve several legal entities?

Often yes, with separate domains, groups and policies per entity. Sometimes separate tenants are needed for legal, regulatory or divestment reasons. Decide deliberately; merging or splitting tenants later is a project in itself.

Do you support sites outside the main cities?

Yes. We cover all seven emirates from our head office in Sharjah, with remote management for day-to-day work and scheduled or dispatched onsite visits. Outside the UAE we provide remote coverage, with teams in 3 countries.

How long does a group standardisation programme take?

Assessment and the written standard take four to eight weeks for a group of five to fifteen sites. Rollout then follows your refresh calendar and budget, usually one wave per quarter. We give fixed quotes per wave after a site survey.

This guide is general information for planning, not legal or tax advice. Regulations and deadlines change; confirm the current position with the official source linked in the text and with your own advisers. Last reviewed 17/10/2026.