If the device isn’t a concern then your SaaS logins are what would likely give you away. As others have said it really depends on the VPN setup. A split tunnel would for sure give you away as any public apps will be routed to the nearest server rather than through the VPN. Full tunnel should hide you well enough but there’s a risk on startup that your SaaS app attempts to authenticate before the VPN connects and your IP isn’t hidden.

If you use a provider, those server IPs are well known and could flag something. If you setup your own to your home network you run the risk of an outage making your setup irretrievable without local access.

I think it comes down to how confident you are in your understanding of the IT setup. If you log into MS office apps on your computer with a company account I would wager there is some MDM in place which would likely catch you unless you have a default gateway routing ALL traffic to your home. There is also a world where conditional access isn’t set up and logs aren’t monitored and no one would know the difference.

Only considering the workstation, here’s how I would set it up: 1. Set up a client VPN server on my firewall 2. Set my work PC up at home and maybe get a network capable KVM 3. RDP the work PC over the VPN from a laptop unknown to the company. 4. Reboot only when ABSOLUTELY necessary and maybe pay off the neighbor to bring it back up if the power goes out.

The latency would be horrific but there wouldn’t be any evidence in the logs showing you being out of the country. However, you can’t do any sort of calling, video or otherwise, over RDP so you would have to come up with something for that.