Several companies, one site: how to share a network cleanly

Several companies in a group under one roof often share more than they realise: the internet connection, the firewall, the printers, the phone system. For that to work without the companies being able to look into each other’s data, the network needs a clear division. This article covers what is shared, what stays separate and where such projects are most likely to snag in practice. The article is based on a project from 2024.

The starting point

A group with several companies, all at the same site. Over the years the companies grew into one shared network: one connection, one network, every computer able to see every other. Email ran with a web host and line-of-business software sat on local machines. Who was allowed to see which data was more a matter of habit than of design.

As long as everything works, hardly anyone notices. At the latest when a company is sold, restructured or audited, the habit becomes a problem. The same goes for malware on a computer in one company.

What is shared and what stays separate

A network segment for each company

Technically, VLANs handle the separation. Each company gets its own virtual network, as do telephony, guests and the management of the network devices. A company’s computers can see each other, but not those of the other companies. The firewall decides whether and how traffic may flow between the networks, not the accident of how the cabling was done.

Germany’s Federal Office for Information Security (BSI) addresses this in its IT baseline protection guidance. For VLANs of different organisations on one switch, it recommends physical separation or encrypting the data. For a group whose companies work closely together and share an owner, separation through VLANs and firewall rules is often appropriate. How far the separation has to go depends on how sensitive the data is. The group should settle that before the planning, not afterwards.

A separate Microsoft 365 tenant for each company

One shared tenant for all companies looks simpler at first glance. Separate tenants fit better with what the companies are in legal terms, though: independent entities with their own data, their own licences and their own responsibility. If a company is later sold or wound up, its tenant goes over as a whole. Nobody has to untangle accounts and files from a shared environment.

Where staff work across companies, Microsoft’s multitenant organisation capabilities offer ways to connect tenants without merging them.

Shared devices

Printers and the phone system are where clean separation needs exceptions. Here the firewall lets computers from every company reach the shared printer. That does not open a path into the other companies’ networks. The phone system sits in its own segment anyway, so that voice calls do not compete with the rest of the data traffic.

How are the costs shared?

Shared infrastructure means shared effort, both during set-up and in day-to-day operation. I bill this effort split between the companies. The group decides which key applies, by workstation for example or in equal shares. What matters is that it is settled before work begins. Negotiating afterwards over who pays what share of a firewall is unpleasant for everyone involved.

Where do projects like this usually snag?

The technology in projects like this is quite manageable. Change requests that only come up after the work is done are harder. One company does need access to another’s files after all, suddenly everyone wants to use a device, or a workstation moves to a different company. Each of these requests is understandable on its own. But if nobody discussed it in advance, it takes extra effort, because the rules, segments and permissions are already in place.

That is why I recommend a separate conversation with each company before the planning. It should clarify who works with whom, which devices they share and which data really has to stay separate. Every company should confirm the result in writing.

Questions before several companies share one network

1. Which companies actually work together? And on which data?
2. Which devices are shared? Printers, phone system, meeting rooms, scanners.
3. How sensitive is each company’s data? That determines how far the separation has to go.
4. Who decides for each company? One contact per company saves many rounds of coordination later.
5. What key is used to split costs?
6. What happens when a company joins or leaves the group?

Frequently asked questions

Can several companies share one internet connection and one firewall?

Yes, if each company gets its own network segment (VLAN) and the firewall controls which traffic may pass between the segments. Without an explicit rule, it lets nothing through.

Do the companies in a group need separate Microsoft 365 tenants?

I set up a separate tenant for each company, because that fits independent entities with their own data, licences and responsibility. If the group later sells a company, its tenant goes over as a whole. For staff who work across companies, Microsoft offers ways to connect tenants without merging them.

Is separation through VLANs enough, or do the networks need to be physically separate?

It depends on how sensitive the data is. For VLANs of different organisations on one switch, Germany’s Federal Office for Information Security (BSI) recommends physical separation or encrypting the data. For a group whose companies work closely together and share an owner, VLANs and firewall rules are often appropriate.

Sources

• Separating network segments, VLANs of different organisations: BSI IT-Grundschutz Compendium, module NET.1.1 Network architecture and design (German), requirement NET.1.1.A23
• Collaboration between several Microsoft 365 tenants: Microsoft Learn – Multitenant organization capabilities in Microsoft Entra ID
• Moving mailboxes between tenants: Microsoft Learn – Cross-tenant mailbox migration