How to Configure AirWatch VPN Policies for Secure Remote Access

Remote work is now part of normal business operations across Australia, from Sydney offices and Melbourne warehouses to regional teams working with variable internet coverage. A well-configured AirWatch VPN policy can give employees reliable access to internal applications while keeping business traffic, credentials and corporate data protected.

AirWatch, now part of VMware Workspace ONE UEM, lets administrators manage VPN settings alongside device enrolment, compliance rules, applications and endpoint security. This centralised approach is useful when staff use company laptops, managed mobiles or approved personal devices under a bring-your-own-device programme.

A VPN policy should do more than switch on encryption. It should define which users and devices may connect, which applications can use the tunnel, how authentication takes place, and what happens when a device falls out of compliance. These decisions determine whether remote access remains secure without creating unnecessary friction for employees.

Australian organisations also need to consider the Privacy Act and Australian Privacy Principles, industry requirements such as APRA expectations, and practical issues affecting regional workers. A policy that works perfectly in a Sydney office may need different testing for staff in Perth, Hobart or remote Queensland locations.

Prepare The UEM Environment

Before creating a VPN profile, confirm that the AirWatch or Workspace ONE UEM console has the correct organisation groups, device ownership records and smart groups. Separate groups might be appropriate for corporate-owned Windows devices, managed iPhones, Android tablets and personally owned devices. This prevents one broad policy from being applied to every endpoint.

Review the operating systems and VPN clients that your organisation supports. Windows, macOS, iOS, Android and rugged devices can require different payloads, authentication methods and certificate formats. Record the internal resources employees need, such as Microsoft 365 services, file servers, intranet applications, VoIP systems and administrative portals.

A wider UEM strategy guide can help clarify how VPN management fits with patching, application control, endpoint compliance and remote support. The aim is to treat secure access as part of endpoint management rather than as an isolated network setting.

Next, verify the network-side requirements with the infrastructure team. Confirm the VPN gateway address, supported protocols, certificate authority, DNS servers, internal routes and firewall rules. If traffic will pass through an Australian data centre or a cloud region outside Australia, document the arrangement for privacy reviews and data-flow assessments.

Choose Authentication And Encryption

Certificate-based authentication is generally stronger than relying on a shared password. Workspace ONE UEM can distribute client certificates through a trusted certificate authority, allowing the VPN gateway to identify an enrolled device or user. Use unique certificates with sensible expiry periods, revocation processes and renewal automation.

Where certificates are unavailable, integrate the VPN with an identity provider that supports modern authentication and multifactor authentication. Avoid creating a separate VPN password that employees can reuse across services. Conditional access can require a compliant device, an approved user group and a successful second factor before the connection is established.

Select a protocol supported by both the endpoint and the VPN concentrator. Common choices include IKEv2, SSL VPN and vendor-specific secure tunnel clients. Use current encryption suites and disable legacy algorithms or weak authentication methods. The exact settings depend on your gateway, so match the AirWatch profile to the vendor’s compatibility guidance rather than copying a generic configuration.

Decide whether the VPN should connect automatically, on demand or only when a protected application opens. Always-on VPN can offer strong control for corporate devices, while per-app VPN may be more appropriate for personal devices. The latter keeps business traffic inside the tunnel without routing an employee’s entire personal browsing session through the organisation.

Build The AirWatch VPN Profile

In the Workspace ONE UEM console, create a device profile for the relevant platform and add the VPN payload. Enter the connection name, server address, authentication method, trusted certificate and protocol settings. Use clear naming conventions, such as “AU-Corporate-Windows-Staff,” so administrators can distinguish production, pilot and contractor profiles.

Use smart groups to target the profile. A finance group may need access to a protected accounting application, while field technicians may require a different tunnel for service management systems. Scope policies by operating system, ownership type, geographic business unit or compliance status. Keep the initial assignment limited to a pilot group before expanding it.

For Windows and macOS, decide whether users need a native VPN configuration or a managed tunnel client. For iOS and Android, configure per-app VPN when only selected business applications require access. Associate the tunnel with the approved applications and prevent unmanaged applications from using the corporate connection.

Define DNS and routing carefully. Full-tunnel routing sends all traffic through the corporate gateway, which provides stronger inspection but can increase bandwidth costs and latency. Split tunnelling can improve performance by sending only internal destinations through the VPN, but it requires accurate route and DNS controls. Any exception should be documented and approved.

Add Compliance And Access Controls

A VPN connection should depend on the security condition of the endpoint. Create compliance rules for encryption, screen-lock requirements, operating system versions, threat detection, jailbreak or root status, and required management enrolment. A device that is missing a critical patch or has been compromised should not retain privileged network access.

Use AirWatch compliance actions to notify the user, require remediation, block the VPN profile or enterprise-wipe corporate data. Give employees a clear recovery path, such as updating the operating system or contacting the service desk. Automatic blocking without useful guidance can lead staff to search for unsafe workarounds.

For BYOD users, limit access to the applications and records they need. Containerisation, managed application settings and selective wipe can protect company data without controlling the employee’s entire phone. This distinction is important under Australian privacy expectations, particularly when personal and business information share the same device.

Access rules should reflect the sensitivity of the resource. A standard intranet page may require managed-device status and multifactor authentication, while payroll or customer databases may require a corporate-owned device, a certificate and a stronger risk signal. Use least-privilege design rather than giving every remote worker broad network access.

Test Performance And User Experience

Start with a controlled pilot that includes different device types, operating systems, locations and network conditions. Test office Wi-Fi, home broadband, mobile hotspots and weaker regional connections. A worker travelling between Brisbane and the Sunshine Coast may experience different performance from someone connecting in a regional town, so measure real use rather than relying only on the administrator’s workstation.

Check application behaviour after the VPN connects, disconnects and reconnects. Test DNS resolution, file access, printing, video meetings, software updates and authentication timeouts. Confirm that users cannot reach prohibited internal systems and that approved applications continue to work when the tunnel is temporarily unavailable.

Pay attention to battery use and connection delays on mobile devices. Always-on settings can be secure but disruptive if the tunnel repeatedly reconnects on unstable networks. For per-app VPN, verify that the managed application starts the tunnel correctly and that data does not leak through an ordinary internet connection during hand-off.

Include secure document handling in the test plan. Some teams may need to print controlled PDFs or forms from a remote application, and a guide to secure PDF printing explains why document permissions can affect legitimate business workflows. Confirm that any printing process follows retention, access and disposal requirements.

Monitor, Review And Refine The Policy

After deployment, monitor connection failures, certificate expiry, authentication errors, gateway load and help-desk incidents. Workspace ONE UEM compliance data and VPN gateway logs should be reviewed together where possible. A spike in failures after a certificate change may indicate a profile issue rather than user error.

Create alerts for unusual activity, including repeated login failures, connections from unexpected locations, simultaneous sessions or access from a device that has become non-compliant. Coordinate these alerts with the security operations team and define who investigates them. Retain logs for a period that supports security investigations while respecting privacy and records policies.

Review VPN profiles whenever the organisation changes identity providers, introduces a new application, retires a gateway or changes its cloud architecture. Remove unused routes, old certificates and inactive smart groups. Policies tend to become risky when exceptions remain in place long after the original project has ended.

Use the following comparison when choosing the most suitable access model for each workforce group:

Access model	Suitable use	Main control	Key consideration
Always-on VPN	Corporate laptops handling sensitive systems	Continuous encrypted tunnel	May increase latency and bandwidth use
Per-app VPN	BYOD phones and targeted mobile applications	Only approved apps use the tunnel	Requires accurate application association
On-demand VPN	Occasional access to internal services	Tunnel starts when rules are matched	Test trigger and DNS behaviour carefully
Full-tunnel access	High-control environments	All traffic passes through the gateway	Needs sufficient gateway capacity
Split-tunnel access	Distributed teams and cloud-heavy workloads	Only defined internal routes use VPN	Requires strong route and data-leak controls

Treat the first 30 days as an operational learning period rather than a set-and-forget deployment. Compare connection reliability, support tickets, user feedback and security events. Adjust group assignments and routing based on evidence, while preserving a documented approval process for every exception.

A secure remote-access programme is strongest when the VPN profile, identity controls, endpoint compliance and application permissions reinforce one another. Configure the policy in a test group, validate it across Australian working conditions, and then expand it with measured safeguards. Use AirWatch’s trial and package information to assess the management features your organisation needs, and involve network, security and privacy owners before production rollout.