AirWatch And VMware Horizon: A Smarter VDI And EMM Strategy
Employees now expect secure access to business systems from laptops, tablets, phones and shared workstations. IT teams need to manage those endpoints while delivering consistent virtual desktops, applications and data access. Combining AirWatch, now associated with VMware Workspace ONE UEM, with VMware Horizon creates a coordinated model for endpoint management and virtual desktop infrastructure (VDI).
The pairing is relevant for Australian organisations balancing hybrid work, field operations and strict data governance. A bank in Sydney, a resources company operating across Western Australia or a public-sector team in Canberra may have very different device estates, yet each needs identity-aware access, reliable support and clear control over corporate information.
How The Platforms Fit Together
AirWatch provides enterprise mobility management and unified endpoint management capabilities. Administrators can enrol devices, apply configuration profiles, distribute applications, enforce passcodes, monitor compliance and remotely lock or wipe equipment. The platform can cover company-owned hardware, personally owned devices and purpose-built endpoints such as kiosks or rugged scanners.
VMware Horizon delivers virtual desktops and published applications from data centres or cloud environments. Instead of storing an entire corporate workspace on every endpoint, an employee connects to a centrally managed desktop session. Horizon can simplify application delivery, especially where software is complex, sensitive or difficult to install across a large fleet.
Used together, the platforms divide responsibility in a useful way. AirWatch governs the device and its access posture, while Horizon governs the virtual workspace. This distinction supports a flexible endpoint strategy: a managed Windows notebook, an Android tablet or a personal Mac can connect to an approved Horizon environment without receiving the full corporate software image locally.
A Unified Access Model
The integration works best when access decisions account for identity, device status and session risk. A user may have valid credentials, but access can still be restricted if their phone is unencrypted, their operating system is outdated or the device has fallen outside a required security baseline. This creates a more precise alternative to treating every successful login as trustworthy.
Single sign-on can reduce friction across Horizon desktops, SaaS applications and mobile services. Multifactor authentication adds another layer, while certificate-based authentication can help identify managed devices. Conditional access policies may allow a compliant corporate laptop to receive a full desktop, while sending an unmanaged personal device to a browser-based application or a limited virtual workspace.
This model also supports bring-your-own-device programmes. Staff can use personal hardware without giving administrators unrestricted control of private content. AirWatch can manage the work container, application permissions and access conditions, while Horizon keeps sensitive files and applications inside the virtual session.
Security And Compliance Controls
A combined deployment helps organisations apply policy before and during a Horizon session. Device posture checks can verify encryption, operating system versions, malware protection, jailbreak or root status and required management profiles. If a device becomes non-compliant, access can be blocked, reduced or directed into a remediation workflow.
Administrators can also build targeted rules for different groups. A finance team might require stronger authentication and a corporate-owned device, while contractors receive access to a restricted desktop with clipboard and printing controls. Guidance on custom compliance rules can be useful when standard policies do not reflect the organisation’s risk model.
Data protection extends beyond the endpoint. Horizon can centralise applications and files, reducing the need to download sensitive information to a local drive. Administrators can manage copy-and-paste behaviour, USB redirection, screen capture, printing and session timeouts according to business requirements. These controls should be balanced carefully so that security does not make routine work impractical.
Comparing The Roles In A Combined Deployment
The technologies overlap in the user experience, but they solve different operational problems. Understanding the distinction helps teams avoid buying duplicate tools or expecting one platform to perform the other’s core function.
| Capability | AirWatch / Workspace ONE UEM | VMware Horizon | Combined Value |
|---|---|---|---|
| Device enrolment | Registers and manages endpoints | Connects to an existing endpoint | Access begins with a known device |
| Application delivery | Pushes mobile, desktop and web apps | Publishes virtual desktops and applications | Local and virtual delivery can be selected by risk |
| Security posture | Checks encryption, OS versions and compliance | Applies session and virtual desktop controls | Device and workspace policies reinforce each other |
| Identity and access | Supports certificates, profiles and conditional rules | Provides access to virtual sessions | Users receive an appropriate workspace |
| Data location | Protects data on managed endpoints | Keeps workloads in a central environment | Sensitive information can remain off local devices |
| Support operations | Remote actions, inventory and troubleshooting | Session monitoring and desktop management | IT gains a broader view of the user environment |
The boundary is especially valuable during incident response. If a phone is lost, AirWatch can revoke corporate access or wipe managed content without waiting for a Horizon administrator to modify every desktop. If a virtual application fails, the Horizon team can investigate the session and application layer without changing the configuration of thousands of endpoints.
Australian Deployment Considerations
Australian businesses often operate across wide geographic areas, so connectivity planning matters. A Melbourne office with strong fibre access, a regional Queensland branch and a mining site in the Pilbara may experience very different latency and bandwidth conditions. Horizon performance depends on the quality of the connection, while AirWatch policy enforcement and device check-ins also need to work reliably across remote locations.
Data residency and privacy requirements should be assessed early. Organisations handling health, financial or government information may need to understand where management data, authentication services, desktop workloads and backups are hosted. The Australian Privacy Act, sector-specific obligations and internal retention rules can influence whether a deployment uses an Australian cloud region, a private data centre or a hybrid design.
Local working patterns also affect policy design. Many Australian workplaces use flexible arrangements around public holidays, school terms and rostered shifts. A policy that forces frequent reauthentication during a long field shift can encourage unsafe workarounds. Strong security should accommodate practical realities for teams in Sydney, Perth, Brisbane and regional locations rather than assuming a single office-based routine.
User Experience And Cost
The main user benefit is consistency. Employees can move between a managed laptop, a mobile device and a home computer while reaching the same approved applications through an identity-led experience. Horizon can provide a familiar desktop, while AirWatch keeps the surrounding endpoint configured and supportable.
There are costs to model beyond software licences. Organisations should account for Horizon infrastructure, graphics requirements, storage, network capacity, identity services, endpoint management, support staff and integration work. A virtual desktop can reduce desktop image complexity, but it does not eliminate the need for well-managed hardware and dependable connectivity.
User behaviour should guide the design. Some teams need offline mobile applications, local peripherals or high-performance graphics that a standard virtual desktop cannot provide. Others benefit greatly from centralised applications and controlled data access. Research into interface habits, including why some services favour a text-based search, can remind project teams to prioritise fast, familiar workflows instead of assuming every user will navigate a complex portal comfortably.
Planning A Practical Rollout
A phased deployment reduces risk and produces clearer evidence about performance, adoption and support demand. Start with a representative group rather than selecting only technically confident users. Include office staff, remote employees, contractors and at least one location with less predictable connectivity.
The rollout should test the complete journey: enrolment, authentication, Horizon launch, application performance, printing, file access, support escalation and offboarding. Measure login times, session reliability, help-desk tickets and policy exceptions. These results can shape the final architecture more effectively than a purely theoretical design.
Useful priorities for an implementation include:
- Define device ownership categories and the access each category should receive.
- Map Horizon desktop pools to job roles, application needs and data sensitivity.
- Establish compliance rules for encryption, operating systems, authentication and lost devices.
- Test regional connectivity, mobile networks and peripherals used by field teams.
- Give service desk staff a unified procedure for endpoint, identity and virtual desktop incidents.
A successful AirWatch and Horizon strategy is ultimately an operating model, not just a product connection. It links endpoint governance, virtual application delivery, identity, security operations and user support. Organisations can begin with a focused 30-day evaluation, compare package and licensing requirements, and use a controlled pilot to determine where virtual desktops create the greatest value. With clear policies and measured testing, Australian businesses can provide flexible access while keeping corporate data and devices under firm control.