IT for DMCC Companies in JLT: A Practical Guide from Flexi-Desk to 50 Staff
What IT a DMCC-licensed trading or advisory company in JLT really needs, from a flexi-desk to a leased office of 50.
Most DMCC companies in JLT need less IT than they expect, but it has to be set up properly. A flexi-desk or very small office can run on Microsoft 365, managed laptops, MFA and a separate backup. Once you lease an office with its own network, add business-grade Wi-Fi, a firewall, a second internet line with failover, documentation and regular support.
Key takeaways
- Flexi-desk and very small offices should stay cloud-first: Microsoft 365, managed laptops, MFA on every account and a separate backup.
- Travelling directors should reach company systems through cloud apps protected by MFA, never through remote desktop exposed to the internet.
- Trading companies should confirm any change to supplier bank details by calling a number already on file, never by replying to the email.
- Offices that trade across time zones need a second internet line from a different provider, with automatic failover on the firewall.
- Older JLT fit-outs often keep usable cabling but need new switches, firewalls and access points, so test before deciding.
- The domain, Microsoft 365 tenant and admin credentials must be registered to the company, not to one partner or a former IT contact.
What IT do DMCC companies in JLT need at each office size?
It depends less on headcount than on whether you control a network. A flexi-desk company lives almost entirely in the cloud; a leased office with its own cabling, Wi-Fi and internet lines needs the network looked after as well.
Many JLT tenants are trading and professional-services companies that start on a flexi-desk or in a small serviced unit, then take a fitted office as the team grows. The mistake is carrying flexi-desk habits into a 30-person office: personal email accounts for suppliers and files on a partner's laptop. The table below is a sensible baseline. Our IT support page for JLT and DMCC covers how we look after these offices.
| Office size or setup | What IT it needs |
|---|---|
| Flexi-desk or virtual office | Company domain, Microsoft 365 with MFA, managed laptops with disk encryption, cloud backup of mailboxes and files |
| Small serviced office on the building network | All of the above, plus a clear rule that company data never sits only on a laptop, and a shared printer set up securely |
| Leased office with its own network | Business firewall, managed switches and access points, separate guest Wi-Fi, a second internet line with failover, a small UPS |
| Growing office of 20 to 50 staff | All of the above, plus standard laptop builds, onboarding and offboarding checklists, documentation and monitored support |
How should travelling directors access company systems securely?
Start with cloud apps and MFA, not a VPN. If email, files and accounting systems live in Microsoft 365 and cloud platforms, a director in a hotel only needs a managed laptop or phone and a strong sign-in.
Turn on MFA for every account, preferably with an authenticator app rather than SMS codes, and block legacy sign-in methods that bypass it. Microsoft 365 Business Premium adds Conditional Access and Intune, which let you require a managed, encrypted device before anyone opens company data. Our guide to MFA for small businesses explains the rollout.
When a VPN still makes sense
A VPN is still useful when a system genuinely lives in the office: a NAS holding archived contracts, an on-premises accounting server or a line-of-business application that cannot move to the cloud. Run it on the firewall, require MFA for every connection and give each person their own account so access can be removed when they leave.
Avoid exposed remote desktop
Opening remote desktop (RDP, normally port 3389) straight to the internet so a partner can reach an office PC is one of the most common ways small offices are breached. Automated scanners find these ports constantly and try passwords around the clock. If someone needs a desktop in the office, put it behind the VPN or use a managed remote access tool with MFA.
How can trading companies stop invoice and payment-diversion fraud?
Combine email security with a payment procedure that does not rely on email at all. Attackers who compromise a mailbox, or register a lookalike domain, can send a genuine-looking message asking you to pay a supplier's new bank account.
Trading companies are attractive targets because they pay large invoices to overseas suppliers, often under time pressure and across time zones. Technology reduces the risk; the procedure is what catches the attempt that gets through.
- Confirm every change of bank details by calling the supplier on a number already held on file, never one given in the email.
- Require a second person to approve new beneficiaries and changes to existing ones.
- Enforce MFA on every mailbox, including shared mailboxes and accounts belonging to partners who rarely log in.
- Publish SPF, DKIM and DMARC records for your domain so others can reject messages forging it.
- Tag external emails and alert on new mailbox forwarding rules, a common sign that an account has been taken over.
Does a JLT office need a second internet line and failover?
If the business trades across time zones, yes. A single line means one fault stops calls, email and trading platforms, often at the hours when Asian or American counterparties are most active.
The practical setup is a second line from a different provider, for example one from du and one from e&, where the building supports both, connected to a firewall that switches over automatically. A mobile 5G or 4G router can serve as the backup where a second fixed line is not available. Put the firewall, switch and access points on a UPS, and test failover by unplugging the main line rather than assuming it works. Our network and Wi-Fi service covers dual-line design and configuration.
How can you tell an older JLT fit-out needs new cabling or network kit?
Look for unlabelled cabling, consumer-grade equipment and nobody able to explain how the network is built. Many JLT offices have been refitted and re-let several times, and each tenant leaves something behind.
- A patch panel with no labels and no port map, so every fault starts with tracing cables.
- A router supplied with the internet line doing the work of a firewall.
- Switches or access points that no longer receive firmware updates from the vendor.
- Wi-Fi that drops in meeting rooms or at desks furthest from the access point.
- A comms cupboard without ventilation that runs hot through the summer.
- Cable runs added over the years through ceilings with no record of where they go.
Refresh or replace?
Test the cabling before deciding. If existing runs pass certification and reach the desks you need, keep them and replace the active kit: firewall, switches and access points. Replace the cabling when runs fail testing, the layout is changing, or you need outlets where none exist. Cabling works in towers normally need building management approval, so allow time for it.
Moving between JLT clusters or to a bigger office
Order internet lines for the new office early, survey the space before the fit-out is finished and have the network live before moving day. Our office IT relocation checklist sets out the order of work.
How do you keep the domain, tenant and data owned by the company?
Register everything to the company and hold the master credentials centrally. In partner-led firms, the domain is often bought on one partner's personal card and the Microsoft 365 tenant was set up by a freelancer who has since moved on.
Transfer the domain to a registrar account in the company's name, keep at least two global administrator accounts for Microsoft 365 with one emergency account stored securely, and give your IT provider delegated rather than exclusive access. Use shared mailboxes for addresses such as accounts and trading desks, so they survive staff changes. When someone leaves, block sign-in, convert their mailbox to shared if needed and move their OneDrive files to a manager.
Backing up Microsoft 365 and shared files
Microsoft keeps the service running, but its retention of deleted items is limited and it is not a backup you control. A separate Microsoft 365 backup covering mail, OneDrive, SharePoint and Teams protects against accidental deletion, a malicious leaver and ransomware syncing encrypted files to the cloud. If the office also has a NAS, back it up off site and test restores regularly. Our Microsoft 365 and cloud service includes tenant setup, ownership and backup.
Is a remote support plan enough, or do you need full managed support?
A remote plan with on-call visits suits a small, cloud-first office. Full managed support makes sense once you run your own network, firewall, second line or NAS, or when an outage would stop trading.
A five-person advisory firm on a flexi-desk mainly needs account administration, laptop management, MFA, backup checks and someone to call. A 40-person trading office with its own network needs monitoring, patching, failover testing, documentation and engineers who can be on site when a switch fails. Many JLT companies move from the first to the second as they grow. Our comparison of managed IT and break-fix support explains the trade-offs.
How Listonics helps DMCC companies in JLT
Listonics engineers work on site across Dubai, including JLT, with remote support UAE-wide. For a flexi-desk or small office we set up Microsoft 365, MFA, managed laptops and backup. For leased offices we design the network, firewall and second-line failover, and refresh cabling in older fit-outs. Managed IT support is a fixed monthly fee per user or per device, with 24/7 monitoring under a managed plan and a network diagram, asset register, account list and port map handed over. Start with a free office IT assessment and talk to Listonics about the right level of support.
Frequently asked questions
A flexi-desk company needs a domain registered to the company, Microsoft 365 with MFA on every account, laptops that are managed and encrypted, and a separate backup of mailboxes and files. It does not usually need its own firewall or server. The priority is making sure company data and accounts belong to the business rather than to individuals.
Not always. If email, files and business applications are in Microsoft 365 and other cloud platforms, MFA and managed devices give secure access without a VPN. A VPN is still useful when a system only exists in the office, such as a NAS or on-premises accounting server. In that case, require MFA and individual accounts for every user.
Call the supplier on a phone number you already hold, not one in the email or attached invoice, and confirm the change with someone you know. Require a second person to approve any new or changed beneficiary. Treat urgency and requests for secrecy as warning signs, even when the email appears to come from a known address.
Yes, where the building supports both providers. The usual approach is a business firewall with two internet connections, set to fail over automatically if the main line drops. Some firewalls can also spread traffic across both lines. Test failover regularly and put the firewall and switches on a UPS so a brief power cut does not interrupt calls.
Not necessarily. Have the existing cabling tested first. If runs pass and outlets are where you need them, keeping the cabling and replacing the switches, firewall and access points is often the sensible option. Replace cabling when runs fail, the layout changes or outlets are missing, and allow time for building management approval.
The company should hold at least two global administrator accounts, with one emergency account stored securely, and your IT provider should have delegated admin access. Avoid a setup where only one partner or an outside contractor holds the master credentials, because leaving staff or a disputed contract could lock the business out of its own email and files.
Published Sep 13, 2026 · Last reviewed September 13, 2026 · 1,838 words
