How to configure AirWatch for secure public Wi-Fi access
Public Wi-Fi is a normal part of daily work in Australia, not an edge case. A sales representative may connect from a Melbourne café, a Sydney airport, a shared office in Brisbane or a phone hotspot while travelling by rail, using both a company phone and a BYOD laptop. AirWatch can reduce the risk of those connections by treating unknown networks as untrusted and applying consistent identity, VPN and application controls.
The objective is not to make public Wi-Fi disappear, but to prevent it from becoming an unmanaged path to company resources. This guide explains how to configure AirWatch for secure public Wi-Fi access, with a practical focus on Australian privacy obligations, mixed Android and iPhone fleets, and staff who work across offices, homes, client sites and shared hotspots.
Map public Wi-Fi risks to Australian work
Start with the network threat model. A café or airport hotspot may be genuinely shared, but it can also be impersonated through an evil-twin access point. Captive portals can expose connection metadata, while compromised routers may attempt DNS manipulation or direct users to fake sign-in pages. HTTPS still protects much application traffic, so policy should preserve verified encryption while controlling where traffic goes and which devices may use it.
For Australian organisations covered by the Privacy Act 1988, endpoint decisions often connect directly to privacy duties. The Australian Privacy Principles require reasonable steps to protect personal information, while the notifiable data breach framework requires assessment and notification of eligible breaches involving customer, employee or health information. AirWatch evidence such as device compliance, network state and application activity helps administrators demonstrate that risk was actively managed rather than left to the user.
The Australian Signals Directorate's Essential Eight also favours explicit access control, patching and monitoring, and agencies or regulated sectors may add state, territory or sector requirements. A practical baseline is to send sensitive corporate traffic through an encrypted tunnel, restrict unmanaged apps and keep downloadable data to a minimum. Local hosting does not remove these needs, so assess the security, latency and support terms of a supplier offering managed cloud hosting whenever its infrastructure will carry company traffic.
Define network trust and assignment rules
Create groups before profiles. In the AirWatch console, organise corporate iOS, Android and BYOD devices into smart groups based on ownership, platform, compliance and application entitlement. Give field teams and executive devices distinct assignments where their exposure differs. This allows a public-network rule to target the right population without weakening controls for specialist systems.
In the device profile editor, open the Network area and configure the Networks payload; menu names vary across console generations. Mark known enterprise networks as trusted and make every other network untrusted. Trust should depend on controlled infrastructure, such as a verified DHCP gateway, IP range or enterprise DNS, not on an SSID alone because a nearby attacker can copy a familiar name. Mobile hotspots and airport or café networks should remain untrusted even when the employee has authenticated to the portal.
Use assignment criteria to place devices in the correct policy scope, and set compliance conditions so sensitive apps and corporate access are blocked while required checks are failing. Test captive portal behaviour before deployment. Users should complete the venue's portal without entering corporate credentials; the corporate sign-in should appear only after the endpoint validates the company certificate and the user completes multifactor authentication.
Configure Wi-Fi, VPN and certificate profiles
Deploy a managed Wi-Fi profile that defines approved networks and proxy or PAC settings, then add the required certificate authority as a separate certificate payload where applicable. Where supported, configure a randomised private address for corporate SSIDs and managed auto-join settings for known networks. The profile should make the safe path predictable while leaving public networks visible for controlled exceptions.
Add a VPN profile using IPsec or SSL. Choose per-app tunnelling for managed email, collaboration, browser and line-of-business apps; use device tunnelling when comprehensive protection is required for field or engineering devices. An always-on option is appropriate for high-sensitivity roles on platforms that support it. Route DNS through the tunnel and, on managed Android and appropriately supervised iOS devices, block traffic that attempts to bypass it. Require MFA and a device certificate instead of relying on shared credentials.
Certificates should be issued to the enrolled device, scoped to the intended server and revocable through the console. Check certificate expiry and renewal before employees reach an airport or regional office with unreliable connectivity. A stolen device should fail the VPN and managed-app checks immediately after its status changes, so certificate revocation and remote wipe must be integrated with incident procedures.
Connecting to an enterprise gateway introduces latency and availability questions, especially across Australia's large distances and varied fixed-line networks. Measure authentication time from Sydney, Melbourne, Brisbane and Perth rather than relying on laboratory results, and define a fallback for gateway outages. If full tunnelling is too restrictive, use a managed browser and application tunnel for business systems while retaining on-device encryption and policy checks for other traffic.
Protect applications and company data
Apply application controls as a second layer. Route sensitive apps through the app tunnel, require single sign-on with conditional access, and use managed open-in rules so work files cannot be copied into personal accounts. Where supported, enforce encrypted storage, restricted clipboard transfer, screenshot limits, document save controls and remote removal of cached corporate data. These settings close an export path that encryption alone cannot close.
Treat web filtering as a separate requirement from network trust. An Australian employer's acceptable-use policy may restrict online gambling, and a category test should verify the exact URL and redirects rather than matching every domain from a hosting provider. A controlled test can use a known sample, such as this gambling content review, after which the resulting category and device action should be documented without making the page available to staff.
For BYOD enrolments, separate personal and corporate data wherever the platform permits, and deny access to regulated records unless device compliance, minimum OS version and current enrolment are confirmed. A BYOD phone may receive email through a managed container while sensitive applications remain blocked. App permissions should follow least-privilege principles, and the user should see a clear reason when a request is refused.
Pilot, monitor and enforce the configuration
Pilot in stages with employees who regularly connect outside the office. Ask them to test café, airport, regional travel and tethered-hotspot scenarios in Sydney, Melbourne, Brisbane and Perth, including captive portals, weak signal and VPN reconnection. Record sign-in time, DNS failures, certificate renewal, battery impact and application behaviour. Test both current and previous operating-system versions because managed controls can differ.
Monitor console alerts for unknown certificates, repeated VPN failures, rooting or jailbreak signals, disabled settings and unusual data transfers. Review network and compliance changes regularly because a network previously treated as trusted can later be replaced or spoofed. Dashboards should identify devices that remain untrusted for too long or use sensitive applications while non-compliant.
Give staff a short, specific routine: connect only to the network name shown by the venue, complete the portal without entering corporate credentials, open managed apps, and report a suspicious sign-in page instead of overriding it. Publish the AirWatch service status and a clear path for replacing a lost device. Quarterly access reviews should remove stale groups, old certificates and app permissions that no longer have a business owner.
| Control | Trusted enterprise network | Public Wi-Fi | AirWatch response |
|---|---|---|---|
| Trust state | Matched to an approved gateway, IP range or DNS configuration | Untrusted by default, including mobile hotspots | Enforce through the managed network profile |
| Traffic path | Corporate tunnel where required | Sensitive applications use an application tunnel | Prevent DNS leakage and policy bypass |
| Identity | Device certificate, MFA and compliant status | The same checks plus network context | Revoke access or quarantine failed devices |
| Data handling | Full application policy and data-loss controls | Restricted sync, saving and clipboard use | Apply remote wipe and least-privilege permissions |
| User experience | Fewer prompts and broader system access | More prompts while access remains available | Display clear status and provide self-service support |
Use AirWatch’s fully functional 30-day free trial to build this configuration in a controlled pilot. Compare pricing and package options, review customer stories for comparable BYOD and field deployments, and contact the sales team to confirm licensing, implementation support, certificate services and requirements for protecting Australian personal information. Start the trial and schedule a controlled rollout for your Australian workforce.