Working Abroad on a VPN: What Your Employer Can Still See
What a personal VPN hides from your employer and what it does not: company VPN, laptop telemetry, Wi-Fi location and time zone.
The belief that a personal VPN keeps your employer in the dark about your country is just that, a belief. It changes the public IP that websites observe. Your whereabouts still surface through the company VPN gateway, the sign-in system, the managed laptop and its clock. To say it plainly: this guide covers what an employer can see, not how to mask a location, and it does not recommend trying.
Why a personal VPN does not hide your country from work
A commercial VPN shifts your traffic through a provider's server, so public sites and the café network log that server rather than your home line. That is where the change ends. The device itself, the work account, the laptop's location services and its clock are untouched, and those are what your employer's tools inspect.
The company VPN sees where the tunnel starts
The gateway logs the public IP each corporate session begins from. Geolocation databases map that address to a city or region, occasionally hundreds of kilometres out because they store the ISP's registered site, yet the country is nearly always correct.
A personal VPN underneath turns the home broadband address into a commercial data-centre one, an odd sight for an employee supposedly at the kitchen table, and some corporate clients refuse to run beside another VPN. IT staff write that some US-only companies block foreign IP ranges outright.
The VPNRadarLab business VPN ranking lists 114 business VPN products. Of these, 79 state a dedicated gateway the company itself controls, 3 say no and 32 do not say, while 42 state split tunnelling, the feature that decides which traffic passes through the corporate tunnel, and 72 do not say.
Single sign-on: the IP at login and the anonymous VPN flag
Every login to a Microsoft tenant lands in records that are system generated and cannot be edited or deleted. Conditional Access, which resolves the sign-in IP to a country from a periodically updated mapping table, can also take GPS coordinates from the Microsoft Authenticator app where policy requires it. Once permission is granted, the app reports the phone's location every hour, silently, for the next 24 hours, and it rejects sign-ins when that location looks altered or the device is jailbroken. Admins can block countries the organisation never operates from.
Entra ID Protection adds risk detections: "Anonymous IP address" flags sign-ins from Tor or anonymising VPNs in real time, even on the free tier, while other rules catch an impossible jump between distant places, a login from a new country, or an IP, device or browser unlike your history.
What a managed laptop reports: MDM and telemetry
Device management turns the laptop into a location source. With Intune, the Locate device action shows a managed machine on a map with address and coordinates on Windows, supervised iPhones and iPads, and corporate-owned Android. Windows needs a policy granting location access, Android work devices show a one-time notification that Intune can access location, and the position is taken when an admin runs the action, then kept for 24 hours. Dedicated Android devices report the last known location every eight hours or at check-in, stored for up to seven days.
What the products' own privacy policies declare is a separate question. Across the 114 business VPN products in the VPNRadarLab ranking, 21 state they collect the connection IP, one partly, two say no, and 90 do not say, which means the vendor's policy omits it, not that nothing is gathered. 37 state they collect device information, 77 do not state it.
Wi-Fi positioning and the clock
The device knows where it is without any VPN. The Windows location service reads GPS, nearby wireless access points and routers, cell towers and the IP address, and the same service sets the automatic time zone. Android combines Wi-Fi access points, cell towers, GPS and sensors like the accelerometer, which is why it works indoors where satellite fixes fail. These radio scans run beside the tunnel and never touch your IP address.
The clock informs quietly. Automatic time zone switches the laptop to local time on arrival, and that offset appears in calendar invitations, email headers and chat timestamps. Colleagues notice replies arriving in the middle of their night. Browser calls add one more channel: WebRTC can reveal the local provider's address when split tunnelling leaves the browser outside the VPN or the tunnel handles IPv4 only on an IPv6 network.
Which signals reveal your country, and which a personal VPN changes
| Signal | What it tells the employer | Does a personal VPN change it? |
|---|---|---|
| Company VPN gateway log | Public IP where the tunnel started | Shows a data-centre address instead |
| Sign-in records | Country of each login, risk flags | Can trigger an anonymous-IP flag |
| Authenticator GPS | Phone location, reported hourly | No; altered GPS fails the sign-in |
| MDM Locate device | Device pinned on a map | No |
| Wi-Fi and cell-tower positioning | Location from nearby networks | No |
| Time zone and timestamps | Local time in meetings, mail, chat | No |
| WebRTC in browser calls | Local provider address outside the tunnel | The address can still show when the browser runs outside the tunnel |
What is at stake: tax, the employment contract and the visa
Rules depend on your citizenship, the country you work from, your visa and your contract, so treat this as general information rather than legal or tax advice.
Tax residence follows days of physical presence. In the UK the tax year runs from 6 April to 5 April, and the automatic UK test makes you resident after 183 or more days in the country; the automatic overseas test applies with fewer than 16 days in the UK, or 46 if you were not resident in the previous three years, or with full-time work abroad averaging at least 35 hours a week and fewer than 91 UK days, no more than 30 of them working. Residents normally pay UK tax on all income. The IRS taxes US citizens and resident aliens on worldwide income, and the foreign earned income exclusion requires either bona fide residence for an entire tax year or at least 330 full days abroad in 12 consecutive months.
Employment contracts usually name a place of work, and remote-work policies often require written approval before working from another country, so undeclared work can end in disciplinary action or dismissal. A UK Standard Visitor entry (up to 6 months) covers a fixed list of business activities, and any other work needs a work visa.
The honest way to work from another country
Ask the employer in writing before you travel, naming the country and the dates, let HR and payroll check the tax and social security consequences on both sides, and confirm your entry status allows remote work or apply for a visa that does. Use the company VPN as IT configured it, and keep a personal VPN for privacy on public networks only where IT allows it.
Working abroad with a VPN: FAQ
Can my employer track my personal phone?
Only through what you install or enrol, such as a work profile or the Authenticator app under a GPS-based sign-in policy.
Is it illegal to work abroad with a VPN?
The VPN itself is almost never the problem. Undeclared work under the wrong visa or without tax registration is.
What your employer sees, in short
Your country shows up in the company VPN gateway log, in every sign-in record, in the managed laptop's location and in the clock, and a personal VPN alters none of it while adding an anonymous-IP flag of its own. Before travelling, get written approval, have payroll check the tax side in both countries and confirm your visa covers remote work.