AirWatch Conditional Access for Location-Based App Control
Mobile work has changed how Australian organisations protect business applications. Staff may sign in from a Sydney office, a Melbourne café, a home in Perth or a regional worksite, often using the same managed phone. AirWatch, now delivered through VMware Workspace ONE UEM, helps administrators apply device and access controls across these varied environments.
Location-aware access adds another decision to the usual identity and device checks. A user might be allowed to open a scheduling app from an approved corporate network, while access to a finance or operations system is blocked from an untrusted region. This approach can reduce exposure without banning mobility altogether.
The strongest policies combine location with user identity, device health, application sensitivity and network risk. GPS alone is rarely a sufficient security signal. A well-designed Workspace ONE deployment can use enrolment, compliance status, certificates, application controls and conditional access integrations to create a more reliable decision.
How Conditional Access Works
Conditional access is a policy engine that decides whether a person can use a particular application under defined circumstances. The conditions may include group membership, device ownership, operating system version, encryption status, authentication strength, network source and location. The outcome can be access, access with step-up authentication, read-only use, or a block.
In an AirWatch environment, Workspace ONE UEM manages device configuration and compliance. Workspace ONE Access can provide identity and single sign-on capabilities, while integrations with identity providers can contribute additional signals. An administrator might require a compliant, encrypted iPhone enrolled in UEM before granting access to a company app.
Location rules can be applied at different levels. A policy may trust a known office network, allow access within an approved geographic area, or deny connections associated with a high-risk country. The precise options depend on the Workspace ONE edition, connected identity services and application architecture, so organisations should verify the capabilities included in their licence and current release.
Choosing Reliable Location Signals
There is a meaningful difference between physical location and network location. GPS can indicate where a managed mobile device reports itself, but it may be unavailable indoors, disabled by the user or affected by poor reception. IP geolocation is easier to use, though mobile carrier traffic, VPNs and cloud gateways can make the apparent location differ from the user’s real position.
A corporate Wi-Fi network, managed VPN or private access gateway may offer a more dependable signal for office-based controls. Even then, an approved network should not automatically make every request trustworthy. Stolen credentials, compromised devices and misconfigured wireless services can still create risk.
Australian organisations should also account for the scale and geography of local operations. A mining company may need secure access at a Pilbara site with limited connectivity, while a retailer could have staff moving between Brisbane stores and personal networks. Policies should distinguish a genuinely unsupported connection from a deliberately suspicious one, with a safe fallback such as multifactor authentication or limited application access.
Applying Rules to Different Applications
Not every application needs the same location restriction. A public-facing collaboration tool may remain available from anywhere, provided the device is compliant. A payroll console, customer database or industrial control dashboard may require a managed device and an approved network. Separating applications by risk prevents a single rigid rule from disrupting ordinary work.
Bring-your-own-device programmes require particular care. A personally owned Android phone may be suitable for email through an approved container, but unsuitable for applications containing sensitive customer records. Workspace ONE can support enrolment, application distribution and compliance checks, while app-level controls help keep business data separate from personal content.
Location restrictions can also be paired with time and device rules. For example, an administrator might permit a warehouse application from a designated facility during operating hours, but require stronger authentication outside that pattern. These controls should be tested against legitimate travel, public holidays, shift work and emergency response scenarios before enforcement.
Australian Privacy And Governance Considerations
Location data is personal information when it can be linked to an identifiable employee or contractor. The Privacy Act 1988 and Australian Privacy Principles create obligations around collection, use, security, transparency and retention. A business should document why location information is needed, limit collection to that purpose and explain the practice through a clear privacy notice.
The Notifiable Data Breaches scheme is also relevant. If location records, device identifiers or access logs are exposed in a breach and serious harm is likely, the organisation may need to notify affected individuals and the Office of the Australian Information Commissioner. Strong access controls, retention limits and audit procedures reduce the impact of an incident.
Australian data residency and cross-border transfer requirements may influence the selected Workspace ONE architecture and cloud services. Legal, privacy and security teams should establish where telemetry and audit records are stored, who can access them and how long they are retained. Employee monitoring laws and workplace consultation requirements may also apply, particularly where location controls could affect performance management or disciplinary decisions.
Practical Policy Checks
A policy should be understandable to the support team and explainable to the person affected. Silent blocking creates unnecessary service desk calls, especially for travelling staff or users working in areas with inconsistent mobile coverage. Clear error messages can direct a user to connect to the corporate VPN, update the device, complete multifactor authentication or contact support.
Before enabling a location restriction, test it with representative devices and networks. Include corporate Wi-Fi, home broadband, mobile hotspots, VPN connections, international travel and regional Australian locations. Review false positives regularly, because IP databases and carrier routing can change without notice.
Useful checks for a deployment include:
- Confirm the business purpose for every location condition.
- Define an exception process for travel and emergency work.
- Set a retention period for location and access logs.
- Give service desk staff a way to diagnose policy decisions.
Operational safeguards should include:
- Use a report-only or audit mode before blocking access.
- Combine location with device compliance and multifactor authentication.
- Provide a controlled break-glass account with strict monitoring.
- Review rules after office moves, network changes or acquisitions.
Comparing Location Control Approaches
The best option depends on the sensitivity of the application, the accuracy required and the organisation’s tolerance for user friction. A network-based rule is usually easier to deploy, while device-based location can support field operations. Identity-provider conditions may be useful when applications already use a central sign-in service.
No method is perfect in isolation. Layering signals produces a more defensible decision, such as allowing access only when a managed device is healthy, the user has completed strong authentication and the connection matches an approved context. For high-risk applications, an explicit denial may be appropriate; for lower-risk tools, step-up authentication can preserve productivity.
| Approach | Useful signal | Advantages | Limitations | Suitable use |
|---|---|---|---|---|
| Corporate IP or Wi-Fi | Known office or site network | Simple and familiar to administrators | VPNs, carrier routing and shared networks can mislead | Office-only applications |
| GPS or device location | Reported physical position | Helpful for mobile and field-work scenarios | Privacy, battery, reception and spoofing concerns | Site-based operational apps |
| VPN or private gateway | Connection through a controlled service | Centralised logging and stronger network assurance | Requires reliable connectivity and user setup | Sensitive internal systems |
| Identity-provider location rule | Sign-in context and risk data | Works across web and cloud applications | Depends on provider data and integration | SaaS and federated access |
| Layered conditional access | Location plus device, identity and risk | Stronger overall decision quality | More planning, testing and support effort | High-value business systems |
Rolling Out And Measuring Access Policies
A staged deployment is safer than an immediate block. Start by identifying applications, data classifications and user groups. Map normal working patterns across metropolitan offices, home workers, travelling executives and regional teams. Then run policies in monitoring mode to discover unexpected connections and estimate the volume of exceptions.
Workspace ONE dashboards, compliance reports and identity-provider logs can help correlate device status with access outcomes. Useful measures include blocked attempts by reason, repeated authentication challenges, unenrolled devices, policy exceptions and help desk incidents. A high block rate may indicate genuine attack activity, but it can also signal an inaccurate geolocation database or a poorly defined rule.
After the pilot, enforce the highest-value controls first. Require managed and compliant devices for sensitive applications, use multifactor authentication for unusual locations, and keep lower-risk services available under less restrictive conditions. Schedule reviews whenever an office network changes, a new application is introduced or Australian privacy guidance affects the monitoring model.
AirWatch and Workspace ONE can support a location-aware access strategy when the controls are matched to real business conditions. Organisations should begin with an inventory of applications and data, validate the available licensing and integrations, and involve privacy, legal, security and workplace teams before collecting location signals.
A controlled 30-day trial can provide a practical way to test enrolment, compliance policies, application delivery and conditional access flows with representative Australian users. Use the trial to measure false positives and support demand, then compare package options and involve the sales team for architecture guidance before committing to production.