Why Your Network Matters More Now Than It Did Five Years Ago
Before Microsoft 365, a business could survive an internet outage. Email sat on a local Exchange server. Files lived on a file server down the hall. Teams used a phone system that didn't depend on an internet connection. An hour without internet was annoying — not a crisis.
That's no longer true for most Melbourne businesses. If your internet goes down today, you lose email, you lose Teams calls, you lose access to SharePoint files, and in many cases you lose access to your line-of-business applications that have moved to cloud hosting. An hour without internet is now a significant business disruption.
The network design that was adequate in 2018 is not adequate in 2025. This guide explains what needs to change and why.
A network built for Microsoft 365 needs: a reliable primary internet connection, a failover backup connection, a firewall that prioritises M365 traffic, and a network design that keeps your traffic flowing efficiently to Microsoft's servers — not bouncing through unnecessary hops.
The Three Problems That Kill M365 Performance
When Microsoft 365 feels slow or unreliable, the cause is almost always one of three things: internet connectivity problems, firewall misconfiguration, or poor network design. Understanding which one you're dealing with determines how you fix it.
A single NBN or fibre connection is a single point of failure. When it goes down — and eventually it will — so does everything that runs on top of it. For an M365-dependent business, this is the highest-risk gap in the network.
Microsoft 365 is optimised to connect directly to Microsoft's global network from your location. If your firewall is routing M365 traffic through a VPN tunnel, a web proxy, or SSL inspection, you're adding latency and choking throughput. Teams calls are particularly sensitive to this.
On a flat network with no Quality of Service configuration, a staff member downloading a large SharePoint file competes for bandwidth with a Teams video call. The call loses. Voices break up, video freezes, and everyone assumes "Teams is slow" — when the real problem is that nobody has told the network to prioritise real-time traffic.
What a Well-Designed M365 Network Looks Like
The diagram below shows the architecture we typically deploy for a Melbourne SMB running Microsoft 365 across a single office. Each element is explained in the sections that follow.
Element 1 — Dual Internet Connections
The single most impactful thing a Melbourne business can do to improve M365 reliability is add a second internet connection. When the primary link fails, traffic switches to the backup automatically — typically within 30 to 60 seconds — and staff keep working.
The question most businesses ask is: what should the second connection be?
| Failover option | Typical speed | Latency | Cost (monthly) | Best for |
|---|---|---|---|---|
| Second NBN service | 25–250 Mbps | 10–25ms | $80–150 | Offices with two physical entry points |
| 4G LTE failover | 20–80 Mbps | 30–60ms | $40–80 | Most SMBs — cost-effective, no install required |
| 5G failover | 100–500 Mbps | 15–40ms | $60–120 | Businesses needing genuine backup performance |
| Starlink (business) | 100–300 Mbps | 25–60ms | $140–250 | Sites with poor NBN or rural locations |
For most Melbourne SMBs, a 4G or 5G failover router connected to the FortiGate is the right answer. It's cheap to run, requires no fixed-line installation, and is genuinely separate from your NBN infrastructure — so if the pit outside your building gets damaged, the failover still works.
If both NBN services run on the same physical fibre into your building, or through the same exchange, they can both fail simultaneously. True redundancy requires diverse physical paths — which is why a 4G/5G failover is often more resilient than a second fixed line from the same ISP.
Element 2 — Firewall Configuration for M365
Microsoft publishes a list of IP addresses and URLs that M365 services use — and they recommend that these be treated differently from general internet traffic. Specifically, Microsoft asks that you:
- Allow M365 traffic to exit directly to the internet without SSL inspection
- Do not route M365 traffic through web proxies
- Do not route Teams media traffic through VPN tunnels
- Prioritise M365 traffic using QoS markings
Most businesses running a generic firewall configuration are violating at least one of these recommendations without knowing it. The FortiGate makes this straightforward to implement correctly — Microsoft's endpoint categories (Optimise, Allow, Default) map directly to FortiGate policy rules, and SD-WAN rules can be configured to route M365 traffic out the primary link with QoS priority, automatically failing over to the backup link if the primary degrades.
SSL inspection breaks Teams media traffic. If your firewall is performing SSL inspection on M365 endpoints, you will see poor call quality, dropped connections and audio/video desync. The fix is to exclude Microsoft's "Optimise" category endpoints from SSL inspection — this is documented by Microsoft and takes about 20 minutes to configure correctly on a FortiGate.
Element 3 — QoS and Traffic Prioritisation
Quality of Service tells your network which traffic is most time-sensitive and ensures it gets bandwidth priority when the connection is under load. For a Microsoft 365 environment, the priority order should be:
Without QoS, all traffic competes equally. A 2GB Windows update downloading in the background will degrade a Teams call in progress — not because your connection is too slow, but because nobody told the network which traffic matters more. On a FortiGate, QoS policies are configured at the SD-WAN level and can be tied to specific application signatures, meaning Teams traffic is recognised and prioritised regardless of the ports it uses.
Element 4 — VLAN Segmentation
A flat network — where every device is on the same subnet — creates two problems for M365 environments: security risk and broadcast noise.
From a security perspective, a flat network means that if one device is compromised (a printer with an unpatched firmware vulnerability, for example), an attacker can reach every other device on the network directly. VLAN segmentation puts logical fences between device types so that a compromised device can't move laterally to your servers or workstations.
From a performance perspective, broadcast traffic from printers, IoT devices, and guest clients on a flat network adds unnecessary noise that affects network responsiveness. Segmenting these into separate VLANs keeps your staff devices on a clean, quiet network.
For a typical Melbourne professional services office running M365, we recommend four VLANs as a minimum:
- VLAN 10 — Staff devices: Laptops, desktops, docking stations. Full M365 access, internet access, access to VLAN 40 servers. Strict firewall rules from other VLANs.
- VLAN 20 — Printers and IoT: Printers, scanners, smart TVs, access control panels. Internet blocked or restricted. No access to staff VLAN or servers except specific allowed services (print queues).
- VLAN 30 — Guest Wi-Fi: Internet only. No access to any internal resource. Rate-limited to 20Mbps per device. Isolated so guests cannot see each other.
- VLAN 40 — Servers and NAS: On-premises servers, NAS storage, backup appliances. Accessible from staff VLAN only. No internet access except for approved update services.
Restricting administrative privileges and limiting lateral movement are core requirements of the ACSC Essential Eight framework. A properly segmented network directly supports compliance with Maturity Level 1 controls around network access restriction and privileged access management. If you're pursuing Essential Eight compliance, VLAN design is one of the first things to get right.
Element 5 — Microsoft 365 Network Connectivity Principles
Microsoft has published detailed guidance on optimising network connectivity for M365. The three core principles are:
Separate M365 traffic from general internet traffic using Microsoft's published IP and URL lists. Apply specific policies to the "Optimise" category (Teams media, SharePoint, Exchange) that bypass proxy and SSL inspection and receive QoS priority marking.
M365 traffic should exit your network as close as possible to the user — not be backhauled through a central office, VPN hub, or cloud security proxy. Microsoft has Points of Presence (PoPs) across Australia; traffic from Melbourne should hit the Melbourne PoP, not be routed via Sydney first.
Hairpinning is when traffic travels an unnecessary path — from your office to a VPN concentrator, then back out to the internet, then to Microsoft, then back the same way. Every unnecessary hop adds latency. Teams audio is sensitive to latency above 150ms; hairpinning commonly adds 50–100ms or more.
Putting It Together: What to Check on Your Network Today
If you're running Microsoft 365 and haven't audited your network in the past two years, here's a practical checklist to start with:
Unplug your primary internet connection and see what happens. Does your network switch to a backup, or does everything stop? If there's no failover, that's the first thing to fix.
Ask your IT provider whether your firewall is performing SSL inspection on Teams, SharePoint, or Exchange traffic. If it is, and call quality is poor, this is likely a contributing cause.
Microsoft provides a free network connectivity test at connectivity.office.com. It measures latency to Microsoft's servers from your location and flags configuration issues. Run it from a device on your office network.
Ask your IT provider whether your firewall has QoS policies for Teams traffic. If they don't know, the answer is probably no. This is a low-effort configuration change that can measurably improve call quality.
If your printers, staff laptops, guest Wi-Fi, and servers are all on the same IP subnet, your network is flat. This is both a security risk and a performance issue — and is straightforward to fix with a managed switch and proper VLAN configuration.
The Bottom Line
Microsoft 365 is a genuinely excellent platform for Melbourne businesses. But it's only as reliable as the network underneath it. A single internet connection with a misconfigured firewall and a flat network will make even the best M365 deployment feel unreliable — and the cause is almost always blamed on Microsoft when the real problem is on-premises.
The good news is that all of this is fixable. Dual internet with 4G failover, a properly configured FortiGate, QoS policies, and basic VLAN segmentation is not an enterprise project — for most Melbourne SMBs it's a one-day network upgrade that delivers measurably better reliability and security.
If you'd like a network assessment that specifically tests your M365 connectivity, contact the Melbits team. We'll run the diagnostics, show you what we find, and give you a prioritised list of what to fix.