VPN for Company Tools Abroad: Opening SSO Wasn’t the Same as Finishing the Hotfix

The deployment dashboard opened, but my code would not leave the laptop. I was in a Marrakech hotel, trying to correct a pricing rule before our largest customer generated its monthly invoices. Microsoft Teams was connected, the incident document was open and the company login page had accepted my password. Then the terminal returned Connection timed out when I pushed the fix. I blamed the repository, restarted the command and watched it fail again.

The billing run began in forty-six minutes.

A configuration error was applying an old tax rule to one customer’s European subsidiaries. No invoices had been issued yet. If we corrected the mapping before the scheduled run, nothing customer-facing would happen.

If we missed it, finance would have to cancel and regenerate several hundred invoices.

My work trip had been approved. The laptop was company-managed, multifactor authentication was active and IT expected me to use an encrypted full-device connection on public networks.

The problem was not authorization.

It was getting every part of the authorized workflow to function through the same connection.

The company homepage was the easiest part

The hotel Wi-Fi looked excellent.

A speed test showed more bandwidth than I had at home. Video calls were clear, ordinary websites loaded quickly and the company’s Microsoft 365 sign-in page appeared immediately.

The incident channel did not.

SharePoint displayed a location warning, and the administrative dashboard asked for another security check.

Our company used location, network and device information as part of its access policy. Microsoft’s Conditional Access system allows organizations to assess those signals before granting access and to reassess a session when the network changes. (Microsoft Learn)

That security model made sense.

It also meant that “the internet works” was not a useful test.

I needed the identity provider, Teams, SharePoint, source repository, deployment pipeline and customer dashboard to remain available as one working session.

The familiar VPN opened the company tools

I started with the major VPN provider already installed on the laptop.

It had years of public history, a large support operation and several routes in my home country. Those were sensible reasons to trust it during an incident.

I selected a nearby home-region server.

The SharePoint warning disappeared.

Teams filled with messages:

Fix reviewed.

Finance available until 17:00.

Need production confirmation before billing starts.

The repository page opened in the browser.

I pulled the latest branch, changed one configuration value and ran the local test suite.

All checks passed.

Then I entered the push command.

The terminal waited.

After thirty seconds, it returned a timeout.

I tried again.

The browser tools still worked, but the code connection did not.

That changed my judgment. Reaching the company portal was not the same as reaching the tools behind the work.

The hotel network treated the terminal differently

Some hotel and corporate networks allow ordinary browser traffic while interfering with other connections. GitHub’s own troubleshooting guidance suggests moving SSH traffic to the HTTPS port when a firewall blocks the standard route. (GitHub Docs)

I switched the repository connection to port 443.

The push began.

Three objects transferred.

Then the hotel Wi-Fi paused.

The VPN reconnected through another endpoint in the same region.

The terminal connection died.

Teams remained visible for several seconds, then requested a fresh sign-in. SharePoint returned to the access page.

The new VPN route was still in my home country.

It was also a new public address.

I completed multifactor authentication again, reopened the incident document and repeated the push.

This time, the code reached 67 percent before the connection changed.

The fix was still on my laptop.

The billing run was now thirty-two minutes away.

More servers created more fragments

The major provider suggested another server with lower load.

I selected it.

Teams returned.

SharePoint opened.

The repository accepted the connection.

I pushed again.

The code reached the remote repository, but the deployment dashboard lost its session before I could approve the pipeline.

I signed in again.

The company identity page asked me to confirm the new location.

By the time I returned, the approval window had expired.

Every attempt succeeded somewhere.

One route opened SSO.

Another carried the Git push.

Another reached the deployment dashboard.

None kept the whole workflow attached long enough to finish.

Remote workers describe the same practical mismatch on accommodation networks: normal browsing looks fast while the VPN or work connection fails at the exact tool they need. (Reddit)

The hotel’s speed was real.

It was measuring the wrong thing.

A browser extension protected the least useful boundary

I installed a free browser VPN extension and selected my home region.

The SharePoint incident document opened quickly.

Teams web also loaded.

The extension looked attractive because it required almost no setup and kept the browser session stable.

Then I returned to the terminal.

The repository traffic was outside the browser extension.

So was the desktop Teams application.

So was the local deployment tool that signed the production request.

I could use the browser to discuss the fix, but I could not send or release it.

The extension protected the place where the incident was being described.

The work itself was happening elsewhere on the laptop.

With twenty-three minutes remaining, I removed it.

By then, the requirement was clear: one full-device route had to carry the entire toolchain, not merely the company homepage.

The smaller app began with the work situation

I had installed OnlydogVPN^↗ before the trip but had treated it as a backup.

The established provider had more locations, more ratings and a much longer public record. The smaller service’s shorter history and fewer regions were why it had not been my first choice.

But I no longer needed another map of server cities.

I needed a full-device route for sensitive work on unreliable public Wi-Fi.

I selected that situation in the app and chose my home region.

The connection established.

Teams reopened without another loop.

SharePoint loaded the incident document.

I returned to the terminal and pushed the configuration change.

The objects transferred.

The remote repository confirmed the new commit.

The deployment pipeline started.

Unit tests passed.

The configuration check passed.

The production approval button appeared.

I approved it.

The dashboard changed to:

Deployment in progress

A minute later, the new pricing rule reached production.

I opened the customer’s test account and generated a preview invoice.

The correct tax treatment appeared for all three subsidiaries.

Finance checked the same preview from home.

The incident lead wrote:

Validated. Billing run can proceed.

That completed the task.

The company tools had not merely opened. The code had moved from my laptop to production, and the customer’s invoice preview was correct.

The route stayed out of the workflow

The service uses an HTTP/3-based connection designed to remain usable when the underlying network weakens or changes.

The practical difference was already visible.

The major provider gave me several working fragments but changed routes before identity, repository and deployment could remain part of one session.

The browser extension covered company pages but excluded the terminal and desktop tools.

The backup carried the full laptop workflow from sign-in to production validation.

I could not observe the hotel network’s or company identity system’s internal filtering rules. I could compare where each connection stopped.

For this incident, keeping the toolchain together mattered more than opening the dashboard first.

The Wi-Fi failed during the customer check

The production fix was live, but the customer success manager wanted one final confirmation on a call.

I joined Teams and shared the preview invoice.

As she compared the values against the contract, the hotel Wi-Fi disappeared.

The call froze.

My laptop moved to the phone hotspot.

The VPN recovered.

Teams returned.

The SharePoint incident document remained open, and the customer dashboard continued loading in the same session.

The manager pointed to the French subsidiary.

“That percentage is correct now.”

Finance confirmed the billing run.

No one had to wait while I selected another server, repeated multifactor authentication or reconstructed the incident from a different device.

The main job had already succeeded.

The recovery protected the smaller moment afterward: proving to the people responsible for billing that it had succeeded.

One company tool was never the real task

Before that afternoon, I tested remote-work access one application at a time.

Can I open Teams?

Can I reach SharePoint?

Can I sign in to the repository?

Those questions were too small.

The incident required one connected sequence:

Receive the alert.

Read the shared notes.

Pull the current code.

Push the correction.

Keep the authenticated session.

Approve the deployment.

Validate the customer result.

Stay on the review call.

A VPN could pass the first two steps and still leave the company unable to bill correctly.

The familiar provider passed several steps, but not as one continuous job.

The browser extension passed only the browser-shaped parts.

The smaller route carried the complete sequence across the laptop.

That was the standard I had been missing.

The billing run settled the comparison

The established provider remained the larger and more familiar company. It offered more regions, more reviews and years of public operating history.

Its changing routes also turned one approved fix into repeated sign-ins, interrupted pushes and an expired deployment window.

The free extension made the company pages accessible but left the engineering tools outside the tunnel.

The smaller backup had fewer locations and a shorter public record.

It was also the option that kept SSO, Teams, SharePoint, the repository and the production dashboard together until the invoice preview was correct.

I began the incident looking for a VPN that could open the company tools abroad.

The billing run gave me the more useful definition: access was complete only when the work moved through every tool and reached the customer.