How to generate AirWatch compliance reports for management

How to generate AirWatch compliance reports for management is a practical exercise in turning console data into evidence that guides action. For Australian IT leaders, a useful report answers three questions: which devices meet policy, why exceptions exist, and which risks require attention. It should connect device status to ownership, business impact and a clear remediation path rather than dump every technical field.

AirWatch, now associated with VMware, centralises inventory, policy evaluation and endpoint actions across mobile and Windows environments. Administrators typically work through areas labelled Device Management, Compliance Policies, Device List or Reports, although names vary by release and licence. Confirm the views available in your tenant before designing a procedure, then standardise an export that managers can interpret without assistance from a specialist engineer.

For Australian teams, compliance reporting also supports privacy, security and operational governance. The results can inform the Australian Privacy Act 1988 and Australian Privacy Principles, show progress against ASD Essential Eight controls, and expose risk in BYOD and remote work. They should remain an operational tool, with defined access, retention and ownership, rather than become an open-ended collection of device data.

Define what management needs from the report

Begin with a management brief, not a console tour. Specify the decisions the report must support, such as restricting corporate access for unmanaged devices, replacing outdated handsets or allocating remediation work to service-desk teams. Decide whether the audience needs a one-page status, a device-level exception list or both. A clear decision owner prevents a technically accurate report from becoming an unanswered email attachment.

Set the scope using enrolment status, operating system, corporate ownership, geography and business role. Include company-owned and BYOD devices if both can access business resources, but separate their obligations and data. Define the review period and a snapshot time. Without those boundaries, two managers may read the same report differently, particularly when devices move between Sydney, Melbourne, Brisbane and Perth offices or between field and office work.

Assign each report field an owner and purpose. Device user, serial number, last check-in and failed control support accountability; precise location, browsing data or personal content usually do not. Minimise the data collected and protect exported files as confidential. If an exception affects a person’s employment or monitoring rights, involve the relevant Australian HR, privacy and legal teams before publishing individual identifiers.

Build policies around real obligations

Create baseline compliance policies that reflect enforceable controls rather than aspirational settings. Depending on your configuration, evaluate passcode, encryption, OS version, jailbreak or root status, application presence, device ownership and security agent status. Test on representative devices first, because strict thresholds can create large queues of false exceptions if they exclude older equipment still used for a legitimate business function.

Map controls to actual governance requirements. The Australian Privacy Principles, including security and accountability expectations, can justify stronger controls for access to customer, health or employee records. The ASD Essential Eight provides a practical risk baseline, while critical-infrastructure and sector obligations may add sector-specific requirements. Document the mapping so auditors can see why a rule exists; a policy with no stated purpose is difficult to defend.

Use enrolment profiles and user attributes to distinguish corporate devices from personal ones. Strong controls remain appropriate where a BYOD device contains work data, with users informed about monitoring and separation of business and personal information. For Windows-heavy organisations, broader Windows endpoint management guidance can help align desktop controls with mobile policy intent, reducing gaps when a user works across both platforms.

Generate and export the evidence

In the mobility console, open Device Management and then the Compliance Policies or compliance overview area for your tenant. Review each policy’s assignment, enforcement status and evaluation timing. Open the Device List or Device Details view for affected users, select the relevant compliance column, and use the available export or report action. Menu names and export permissions differ across releases, so train administrators on the exact path used by your organisation.

Before exporting, choose a reporting date and apply consistent filters. A useful extract usually includes device identifier, assigned user, ownership type, platform, OS version, policy result, failed reason, last evaluation and last check-in time. Keep management’s summary brief, then retain the detailed export as the working paper. Where the console offers scheduled reports or API access, test them against the manual export to confirm field names, time zones and record counts.

Store evidence according to your Australian records schedule and restrict access to authorised staff. AirWatch and its related VMware tooling may display evaluation times in UTC or a configured console zone. Convert these to Australian Eastern Standard Time or Australian Eastern Daylight Time, whichever applies, and record that conversion in the report legend. This matters during daylight-saving changes and when teams troubleshoot a device in Queensland, which does not use the eastern zone.

Turn report findings into managed action

Triage results by risk rather than raw non-compliance count. A rooted device holding regulated data may outrank an old device with no corporate access. Separate not-enrolled, not-evaluated, compliant, failed and unknown states, because an unknown result is not proof of compliance. Confirm that the endpoint checked in recently and that the console has a current policy version before escalating an exception.

Route each exception into a workflow with an owner, deadline and verification step. The service desk can coach a user on passcodes or enrolment, while endpoint engineers handle encryption, failed commands and unsupported OS versions. Australian managers often prefer a plain-English device health check alongside the technical status. That summary should state the risk, business impact and action required without exposing unnecessary personal details.

Document temporary exceptions with an approver, reason, compensating control and expiry date. A remote worker at a Pilbara mine site, for example, may need a scheduled reconnection rather than immediate enforcement. Record decisions in the ticket or risk register, then rerun the report after remediation. Keep the original failed result and the later passing result so the audit trail shows both the problem and its closure.

Choose the right reporting method

Different audiences need different reporting methods. The built-in compliance view is useful for a live overview; a filtered device export supports detailed follow-up; scheduled distribution supports recurring governance; and an API feed can support enterprise dashboards. Availability of scheduling, fields and API access depends on the AirWatch product configuration, so validate capabilities during a controlled pilot.

The main trade-offs are visibility, detail, effort and historical depth. Use the following comparison to select a method rather than maintaining several overlapping spreadsheets with conflicting totals.

Reporting method	Primary management use	Main advantage	Main limitation
Compliance dashboard	Current fleet status	Fast access to an operational overview	Limited historical analysis and drill-down
Device list export	Detailed exception investigation	Flexible filters and device-level evidence	Requires preparation and manual checking
Scheduled report	Recurring management updates	Consistent delivery with less manual work	Depends on configuration and field support
API data feed	Enterprise dashboards and analysis	Supports automation and detailed trend analysis	Requires technical integration and validation

For a first reporting cycle, combine a dashboard snapshot with a controlled CSV export and validate the totals. Add scheduling once ownership, filters and exception categories are stable. Avoid sending raw console exports to executives; instead, publish counts by risk, business unit and remediation status, with the detailed working paper available through a controlled process.

Make compliance reporting routine

Run compliance reviews monthly for high-risk fleets and quarterly for the wider estate, then repeat them after major OS releases, policy changes or workforce events. Assign owners for policy design, report production, remediation and approval. Trend overdue exceptions, unknown evaluations and time to remediate. These measures show whether compliance is improving rather than merely restating the same dashboard every month.

Start with a controlled proof using a fully functional 30-day AirWatch free trial, representative devices and one high-value policy. Compare package and pricing options, review customer stories for organisations with similar device mixes, and arrange a sales consultation for deployment and support requirements. If the pilot produces clear ownership, reliable exports and an enforceable remediation process, schedule the first production report and invite managers to review it with you.