SMSMC Blog
Security LeadershipOctober 2026 · 5 min read

Several locations, one standard: running a multi-site business on UniFi safely

Each office set up by a different installer, each one slightly different, none of them checked. How to run several locations on UniFi from one standard, one admin list and one update view.

By Jim Venuto

Three offices, three networks, three sets of guesses

Illustration, not a real event: a physical therapy practice opens its third location, in Fishkill. The first office’s network was set up by the original IT company, the second by a cousin, the third by the contractor who did the build-out. One has guest Wi-Fi isolated; one doesn’t. Two record camera footage for thirty days; one fills its drive in eight. Nobody can say which consoles have the latest security fix, and the owner’s login is shared by four people.

Each location works. Together they are a security program nobody designed. Every difference is a place where a mistake hides, and every site you can’t see is a site you can’t vouch for to an insurer or a regulator.

Why it happens

  • Locations are added one at a time, under deadline, by whoever is available.
  • There is no written standard, so each installer uses their own defaults.
  • Management is per site, so checking all of them takes a day nobody has.
  • Admin access spreads: every installer, manager and helper gets a login and keeps it.

The design: one standard, applied everywhere, seen from one place

SMC’s preferred platform for multi-location small businesses is UniFi, because its management is built around many sites under one owner. If your locations already run another platform that serves you well, SMC applies the same standard to it.

1. Write the site standard first

Before touching equipment, write one page that every location follows: the networks (staff, guest, devices, cameras), the firewall rules between them, Wi-Fi names and security, camera retention, door schedules, who gets admin access and which alerts go to whom. This is the document you hand to every installer and check every site against.

2. Manage every site from Site Manager

Site Manager at unifi.ui.com lets you administer every site you own or have been granted access to from one interface, including Update Manager for updates across sites and Admin Management for roles and permissions (UniFi Remote Management via Site Manager).

3. Turn the standard into configuration with a Fabric

UniFi Fabrics group sites under a shared administrative and identity model, with centralized role-based access and identity provider integration, so roles are defined once and applied across sites (UniFi Roles Explained; Site Manager).

Within a Fabric, a Blueprint is a full site configuration (VLANs, firewall zones and policies, Wi-Fi and more) assigned to as many sites as you like; editing it updates every assigned site. A Canvas applies one setting, such as a guest network or a Wi-Fi name, the same way. Local overrides are still possible (UniFi Multi-Site Orchestration and Templating). Your written standard becomes a Blueprint, and a new location starts compliant instead of drifting into it.

Keep overrides rare and written down. Each one is a difference you chose.

4. Connect sites without a tangle of VPNs

Site Magic SD-WAN creates site-to-site connections between UniFi gateways through Site Manager, without manual subnet planning (UniFi Gateway - Introduction to VPNs). Connect only what needs connecting: a shared server or phone system, not every network to every network. The firewall rules in your standard still apply across the link.

5. Cameras and doors across locations

  • Teleport, introduced in Protect 7.3, lets supported remote cameras record to a central Cloud Gateway or NVR, so a small location doesn’t need its own recorder (Introducing Protect 7.3, October 5, 2026). Weigh that against the location’s internet connection: if it drops, check what the camera does.
  • Vantage Point gives centralized management of up to five NVRs or ENVRs (Managing Storage and Retention).
  • In UniFi Access, Fabrics can manage people and their door permissions across sites (Getting Started with UniFi Access), so a manager who moves between offices has one identity, and offboarding happens once.

6. One admin list, reviewed

One business-owned Owner account, two named Super Admins on app-based MFA, narrow roles for everyone else, and a quarterly review of the admin list across all sites. Shared logins end the day the Fabric goes live.

What it looks like in practice

Ubiquiti publishes a customer story about a family medical practice with two clinics in San Juan, Puerto Rico. It describes linking the clinics with Site Magic SD-WAN, adding dual internet providers with LTE backup and battery backup, and running cameras, door access and phones on UniFi; the practice reports cameras staying up through multiple outages (Ubiquiti, Connecting Two OB/GYN Sites with Secure UniFi SD-WAN). It is Ubiquiti’s account of its customer, not an independent review, but it shows the pieces working together at a small scale.

Checklist

  • One-page site standard written and approved
  • Every location visible in Site Manager under business-owned accounts
  • Fabric created; standard built as a Blueprint; overrides listed
  • Update Manager reviewed monthly; no site behind on security fixes
  • Site-to-site links limited to what needs to connect
  • Camera retention and door schedules match the standard at every site
  • Single admin list across sites, reviewed quarterly; shared logins removed
  • New locations start from the Blueprint, then get checked

When to get help

SMC writes the site standard, designs each location against it, specifies the work for your installers, and checks each finished site. SMC doesn’t sell equipment or take commissions. UniFi is our preferred platform; if your locations already run something that fits, we standardize that instead.

Start with the free security assessment at https://www.securitymedic.com/assessment. You get a gap report to keep and a free results review; physical security questions are also covered on a free 30-minute call.

Sources

Tags#physical-security#smb#ubiquiti#playbook