Her use includes checking her work email which is Microsoft Outlook, using programs like turbo tax and Microsoft excel, photos and internet searches. Not real high tech stuff
Once you said "work email" my IT guy radar went up. They may have specific requirements of what must be run on the machine for anything that's attached to their network. They also may be willing to pay for it or even provide a machine if her job requires her to be remote. So... she really should ask them before you waste any money on anything.
They may also have requirements that they have some form of remote access, specific managed anti-virus/security software, a specific vendor's VPN software, and may require a specific version of Office.
Frankly most IT shops are on her side. They'd rather provide the correct gear, configured the correct way for their environment rather than deal with bring-your-own stuff that doesn't work well with whatever they need to run. If they're any good at this IT stuff they do, anyway.
Other examples of possible weirdness: If one of our staff casually looked at one of the businesses computers in one particular Division, they'd say what you said: "It uses Microsoft Outlook". In reality, we're now a Google Suite shop and Outlook really isn't necessary... BUT...
Those users were used to the user interface and especially the bosses who haven't touched anything but Outlook for over a decade, couldn't be bothered with learning how to go to gmail.companydomain.com and reading mail on a browser. They also don't quite realize their calendars are available at a similar URL, all synched and happy across all their devices. Because they don't JUST have Outlook. They have the Google sync tool also installed.
The users who've done anything with GMail since oh, ten years ago... probably have their own Google accounts at home... laugh and "get it" the second we show them that they're really just using Outlook connected to Google and some percentage of them never bother opening Outlook again. No need whatsoever.
But the old folks, their habits die hard.
That Division would lower their software budget dramatically if they weaned themselves off of Office. But they *believe* it's not possible. Their belief is wrong, but we've told them what they pay for their religion and they want to pay it. So we don't argue.
We also have at least one VP who refuses to connect his phone to the email system. We're fine with that, his reasoning is that he doesn't want us to have the ability to remotely wipe his device. We've explained that his bosses signed contracts with customers who require we have that ability on all devices, and it's best practices in case of loss or theft anyway, and we have no intention of ever wiping his phone. (Plus we showed him how to back it up in such a way as we wouldn't know if he restored it and didn't reconnect it to the company, anyway. There's always workarounds on this stuff.)
His decision. The decision to require the wipe was made above his head.
So...just make sure she's communicated with the IT staff at her work that she's looking to do work remotely, and is willing to purchase her own device(es), but wants to know if there's any specific standards or things she must run to do so.
We're pretty "easy" but we require a specific VPN client that can also ban specific software from running when connected to our network, and a specific anti-virus package that we can manage and see if a machine becomes infected or is behaving badly. For mobile devices we must also have remote wipe capability. None of those are negotiable -- like I said, the big bosses signed business contracts with customers who pay a third party to audit us for compliance regularly.
Many places are much much more locked down than the above rules.
Our only malware outbreaks (always easily contained by our tools to one machine) have always been from Windows machines running Outlook. It's a security disaster. Always has been.
If she has an IT group, make sure she talks to them before spending a dime.
