Deploying AirWatch Across Hybrid Cloud Environments
Hybrid cloud has moved from a strategic option to a baseline expectation for medium and large Australian organisations. Operators headquartered in Sydney frequently extend workloads into Microsoft Azure Australia Central, while manufacturers in regional Victoria keep core systems inside local data rooms to satisfy operational technology constraints. The model lets IT teams run sensitive workloads on dedicated hardware while still tapping the elasticity of public cloud regions for development, analytics, and burst capacity.
AirWatch, now part of the VMware family, fits naturally into that duality. The platform's unified endpoint management console can be hosted in the data centre, in a public cloud tenant, or in a combination of both, provided the underlying network, identity, and database tiers are designed to bridge the two. This flexibility is one of the reasons enterprise mobility management buyers in Australia continue to rank the product highly when shortlisting tools for fleets that mix corporate laptops, rugged tablets, and personal smartphones.
This article walks through the practical steps of deploying AirWatch in a hybrid cloud environment, from initial planning through to ongoing optimisation. It assumes a working knowledge of Windows Server administration, basic networking, and the VMware vSphere or vCenter stack. Readers looking for a primer on Windows endpoint management can review the endpoint management resources referenced throughout the community.
Planning the Hybrid Cloud Deployment Strategy
A successful hybrid rollout starts with a written target architecture rather than a vendor quote. Map every component of the AirWatch stack: the console server, the device services server, the email connector, the content gateway, and the database. Decide which pieces stay on-premises, which move to the cloud, and which sit at the boundary. In practice, Australian enterprises often keep the console and database in a Sydney colocation facility while offloading staging environments and mobile flow templates to AWS.
Stakeholder alignment matters just as much as technology selection. Engage security, legal, and the lines of business that own the mobile workflows early. In highly regulated sectors such as banking in Melbourne or healthcare in Brisbane, regulators expect documented evidence of where personal information is stored and processed. A clear deployment plan also makes the eventual audit against the Notifiable Data Breaches scheme far less stressful, because the location of every component is already recorded.
Infrastructure Prerequisites and Network Connectivity
The hybrid model depends on predictable latency between the on-premises components and the cloud-hosted services. AirWatch device check-ins are chatty, so a sub-100 millisecond round trip between data centre and cloud region is the practical target. Establish redundant IPsec tunnels or use a private peering service such as Azure ExpressRoute or AWS Direct Connect to remove dependence on the public internet.
Compute sizing follows a similar split. The on-premises console typically needs a Windows Server 2019 instance with 16 vCPUs and 32 GB of RAM for a 5,000 device estate, while the cloud side usually runs smaller instances for the Mobile Flow and Content Gateway roles. PostgreSQL or Microsoft SQL Server can be hosted either side, but most Australian customers choose SQL Managed Instance in the cloud for the operational database and keep reporting on-premises.
| Component | On-Premises Only | Public Cloud Only | Hybrid Cloud |
|---|---|---|---|
| Console Server | Single Windows VM | Azure VM or EC2 instance | On-prem VM, cloud replica for DR |
| Database | Local SQL Server | Cloud-managed SQL | SQL on-prem with cloud read replica |
| Email Connector | Internal relay | Cloud relay service | Internal relay with cloud relay fallback |
| Content Gateway | Local reverse proxy | Cloud load balancer | Local gateway with cloud edge cache |
| Disaster Recovery | Tape or secondary site | Cross-region snapshot | Warm standby in alternate region |
The table captures the most common configuration patterns seen in Australian tenders. The hybrid column reflects the dominant choice among financial services customers in Sydney who must keep certain workloads within Australian borders.
Identity and Access Management Configuration
Identity is the connective tissue of a hybrid AirWatch deployment. The platform integrates with Active Directory for admin authentication, with LDAP for group lookups, and with SAML or OpenID Connect for user self-service. In a hybrid topology, an Active Directory domain controller typically remains on-premises while a synchronised Azure AD tenant handles cloud-side admin access and conditional access policies.
Certificate enrolment deserves particular care. Australian Privacy Principle 11 requires organisations to take reasonable steps to protect personal information from interference, and device certificates are a recognised safeguard. Configure a Microsoft AD CS hierarchy on-premises, then expose a SCEP or EST endpoint through the AirWatch console so devices receive short-lived certificates regardless of where they roam. Two-factor authentication for admin consoles should be mandatory, ideally through hardware tokens or platform authenticators such as Windows Hello.
Prerequisites for the identity layer usually include:
- A clean Active Directory schema extended for AirWatch service accounts
- A public key infrastructure with online responder for SCEP
- A documented break-glass admin process tested every six months
Application Distribution and Policy Enforcement
Once the identity plumbing is in place, the focus shifts to the apps users actually run. AirWatch groups applications into smart groups driven by compliance status, operating system version, or department membership. For a typical Australian retailer, this might look like:
- A managed shell on corporate-issued Samsung tablets for warehouse pickers
- A wrapped Office 365 suite on BYOD iPhones for head-office staff
- A custom inspection app on rugged Android devices for field technicians
- A public store app on executive devices with no containerisation
Policies are evaluated in near real time, so a device that falls out of compliance can be locked, quarantined, or selectively wiped within minutes. For mining operators in Western Australia, this kind of rapid response is essential when a device is lost on a remote site. The same policy engine also enforces Data Loss Prevention rules, such as blocking copy and paste between managed and unmanaged apps, and restricting cloud backup destinations to the corporate tenancy only.
Data Security and Compliance Controls
Encryption is the first line of defence, but it is rarely the last. AirWatch supports per-app VPNs, app-level AES-256 encryption, and integration with enterprise key management systems. In hybrid deployments, key material often lives on-premises in a hardware security module, with the cloud side calling back through a secure API to unwrap session keys. This pattern keeps the master key under local control while still allowing cloud-resident components to function.
Compliance overlays vary by industry. Healthcare providers across New South Wales and Queensland map AirWatch controls against the Australian Digital Health Agency's security framework, while APRA-regulated entities align the platform with CPS 234 information security requirements. The core technical controls overlap heavily across sectors:
- Device-level encryption with keys escrowed to the enterprise
- Jailbreak and root detection enforced at every check-in
- Remote lock and selective wipe tested quarterly
- Audit logs streamed to a SIEM with twelve months of retention
These four measures form the practical baseline. Mature programmes add mobile threat defence integration and continuous risk scoring on top, particularly for executives whose devices leave Australian jurisdiction frequently.
Integration with Public Cloud Services
Beyond identity, the most valuable integrations tend to involve productivity and collaboration tools. AirWatch publishes deep links into Microsoft Intune for co-management scenarios, into VMware Workspace ONE Access for single sign-on, and into Salesforce for customer-facing field roles. In a hybrid deployment, these integrations can be wired through a cloud-side relay so that on-premises devices do not need direct outbound access to consumer SaaS endpoints.
Content sharing deserves a dedicated integration path. AirWatch Content Locker can mount SharePoint Online libraries, Box folders, and OneDrive accounts as managed repositories. For organisations in the legal sector operating across Perth and Adelaide, this allows confidential documents to be edited on a tablet without ever leaving the protected container. The accompanying PDF decryption review covers the wider question of how encrypted documents move between managed and unmanaged environments, a frequent concern during compliance reviews.
Monitoring, Reporting, and Ongoing Optimisation
The deployment is not finished when the first device enrols. Hybrid environments need continuous monitoring because the failure modes are distributed. Configure the AirWatch dashboard to alert on console heartbeat failures, on database replication lag, and on the queue depth of the email connector. Forward those events to a central observability platform such as Splunk or Datadog so on-call engineers in Adelaide see the same picture as the Sydney operations team.
Quarterly health checks should re-examine the device count per tenant, the database growth rate, and the certificate renewal pipeline. Patch the console on a predictable cadence, ideally aligned with the VMware release calendar, and rehearse the disaster recovery runbook at least twice a year. Hybrid clouds reward organisations that treat the architecture as a living system rather than a one-off project, and the cost of neglect is rarely a clean outage but a slow drift in performance and security posture.
The fastest way to evaluate fit is to start a 30-day free trial of the AirWatch platform, connect it to a test Active Directory forest, and enrol a handful of representative devices. From there, the conversation with the sales team can be grounded in real data rather than assumptions, and the procurement path through Australia becomes much smoother. Pricing and package comparisons are available on the website, alongside customer stories from organisations that have already completed a hybrid deployment at scale.