Best practices for AirWatch patch management on Windows and macOS

Effective patch management keeps business laptops, desktops and mobile endpoints protected without disrupting the people who rely on them. For organisations using AirWatch, now associated with VMware and commonly delivered through Workspace ONE UEM, the goal is to combine visibility, testing, deployment and compliance reporting in one practical operating model.

Windows and macOS require different controls. Windows environments may depend on Windows Update for Business, update rings, quality updates and feature releases, while macOS relies on Apple software update commands, declarative management and device enrolment capabilities. AirWatch can help coordinate these processes, but a strong result depends on sound policies and clear ownership.

Australian businesses also need to account for the Essential Eight, the Privacy Act and the realities of a distributed workforce. A policy that works for an office in Sydney may need adjustment for FIFO staff in Western Australia, a regional Queensland branch or employees working through variable connections outside Brisbane or Melbourne.

Build a reliable endpoint inventory

Patch decisions are only as good as the device data behind them. Start by confirming that every corporate Windows PC, MacBook and shared workstation is enrolled in AirWatch and reporting regularly. Capture the operating system version, build number, hardware model, ownership type, encryption state, last check-in and primary user.

Separate company-owned devices from BYOD equipment. A personally owned Mac used to access email may need a lighter compliance policy than a managed Windows notebook holding customer records. Record whether an endpoint is used for standard office work, point-of-sale operations, development, clinical services or privileged administration.

Use smart groups to organise devices by operating system, business unit, risk and location. Useful groups might include “Windows 11 laptops”, “macOS corporate fleet”, “critical servers excluded from UEM” and “remote users with limited connectivity”. This structure makes staged deployments safer and helps security teams identify devices that stop checking in.

Establish risk-based patch priorities

Not every update deserves the same deadline. Critical vulnerabilities being actively exploited should move through an emergency process, while routine quality updates can follow a predictable monthly cycle. Prioritise endpoints that handle sensitive information, connect to production systems or belong to administrators.

Align the patch policy with the Australian Cyber Security Centre’s Essential Eight, particularly patch applications, patch operating systems and restrict administrative privileges. The policy should define how quickly critical, high and standard updates must be installed, with exceptions documented rather than handled through informal email approvals.

Keep an accurate exception register. A specialist application used by an engineering team in Perth may fail after a feature update, while an older device in a Melbourne warehouse may need a hardware replacement rather than another delay. Each exception should have an owner, business reason, compensating control and expiry date.

Test updates before broad deployment

A pilot ring provides a controlled way to detect application conflicts and hardware problems. Select a representative sample of Windows and Mac devices, including common laptop models, different processor generations, standard business applications and a few remote users. Avoid choosing only IT-owned machines, since they rarely reflect the wider fleet.

For Windows, test monthly cumulative updates, driver behaviour, VPN access, printing, Microsoft 365 applications and line-of-business software. For macOS, verify security updates, major operating system releases, kernel or system extensions, identity tools, endpoint protection and collaboration software. Pay close attention to older Intel Macs and newer Apple silicon devices where application compatibility can differ.

Use AirWatch compliance policies and reporting to confirm installation rather than assuming that a command succeeded. A device can receive an update instruction but remain unpatched because it is asleep, low on battery, short of storage or disconnected from the network. Give users a reasonable maintenance window and communicate restart requirements in plain Australian English.

Use staged deployment and maintenance windows

A practical rollout often has four stages: pilot, early adopters, general users and overdue devices. Hold each stage long enough to review failures, service desk tickets and business impact. The schedule can follow Microsoft’s monthly release cycle, while macOS updates may be managed around Apple’s release pattern and the organisation’s application testing calendar.

Avoid forcing restarts during customer service hours or warehouse shifts. For a national company, consider time zones and local operations: a Sydney office may be finishing its day while a team in Perth is still in the middle of a critical shift. FIFO crews and staff in regional areas may need longer deferral periods because connectivity and access to charging facilities are less predictable.

AirWatch notifications should explain what is changing, why the update matters and when the device must restart. Give users a visible deferral limit, but do not allow indefinite postponement. After the limit is reached, increase enforcement gradually, reserve hard deadlines for serious risk and provide a support path for legitimate business conflicts.

Protect remote, BYOD and high-risk endpoints

Remote work makes patch compliance harder because devices may not connect to the corporate network or a traditional management server. Cloud-based UEM controls, peer-friendly delivery methods and regular check-in requirements help maintain visibility. Monitor devices that have been offline for several weeks, and treat them as unknown rather than compliant.

For BYOD, separate corporate data from personal content through application-level controls, managed applications and selective removal. A personal Mac should not require unrestricted device inspection simply because the user accesses a company mailbox. Explain what the organisation can manage, what it can see and what happens when the user leaves.

Web and application risk also belongs in the endpoint conversation. A browser-control policy can restrict suspicious destinations, unauthorised downloads and risky entertainment services, including casino tournament coverage when it conflicts with acceptable-use rules or exposes users to unnecessary tracking. Combine those controls with endpoint detection, DNS filtering and phishing-resistant authentication rather than relying on a single blocklist.

Use stronger controls for privileged accounts and devices that access regulated information. Require encryption, screen locking, current security tools and a healthy compliance state before granting access to sensitive systems. Australian organisations handling personal information should also consider how patch failures could contribute to an eligible data breach under the Notifiable Data Breaches scheme.

Measure compliance and improve the operating model

A useful dashboard should show more than the percentage of devices marked compliant. Track patch age, critical vulnerability exposure, failed installations, devices missing recent check-ins, average remediation time and the number of approved exceptions. Break results down by Windows and macOS, office, business function and ownership model.

Set thresholds that trigger action. For example, a device without a security update after the agreed deadline can receive reminders first, followed by restricted access or quarantine. Security and service desk teams should agree on the response before an incident occurs, including how to restore access after the patch is installed and the device reports healthy.

Review the policy after every major release cycle. Examine which models failed, which applications caused trouble and whether users understood the messages. Customer-facing organisations in Sydney, Melbourne or Adelaide may need stricter maintenance windows than a small professional services firm, while a national business may need extra testing for regional connectivity and remote support.

Keep configuration changes auditable. Record who approved a deferral, who changed a smart group and why a device was excluded. AirWatch reporting can support evidence for internal audits, supplier reviews and security assessments, but reports should be retained according to the organisation’s governance requirements rather than collected without a defined purpose.

A well-run AirWatch patch programme turns endpoint updates into a predictable business process. Begin by auditing enrolment and device health, define risk-based deadlines, test representative hardware, deploy in waves and measure results continuously. Review your AirWatch or Workspace ONE UEM configuration, start with a controlled pilot and use the available trial or sales resources to validate the approach across both Windows and macOS before expanding it nationally.