Connecting AirWatch to Active Directory for User Sync
For Australian IT teams managing fleets of corporate devices, keeping user accounts, permissions and group memberships aligned between on-premises directories and a cloud mobility platform is no longer optional. When an employee relocates from the Sydney head office to a regional branch in Newcastle, or a contractor joins a Brisbane mining project for a six-month rotation, the changes need to flow automatically to every managed laptop, tablet and phone. Pairing AirWatch with Active Directory delivers that consistency, but only if the configuration follows a clear plan that respects local compliance requirements.
Australian organisations operate under the Privacy Act 1988 and the Australian Privacy Principles, which dictate how personal information is collected, stored and disclosed. Synchronising directory data into a mobility management console touches those obligations directly, because user attributes often include identifiers that qualify as personal information. Administrators in Melbourne financial services firms, Canberra government agencies and Perth energy companies must therefore map out identity flows before flipping a single switch, ensuring the integration supports audit obligations rather than complicating them.
The practical payoff is straightforward: a single source of truth for identity, fewer help desk tickets, and a mobile workforce that can authenticate to corporate resources without manual provisioning. With the Notifiable Data Breaches scheme elevating the cost of exposed credentials, getting user sync right is also a defensive measure rather than a purely operational one.
Preparing Your Active Directory environment
Before touching the AirWatch console, the underlying directory needs to be in good shape. Forest functional levels should be at least Windows Server 2012 R2, and the domain controllers must be reachable from the AirWatch appliance or cloud connector on the relevant LDAP ports. Australian administrators frequently host a dedicated service account in a protected organisational unit, separate from privileged administrator credentials, which keeps delegation tidy and audit logs clean.
Group strategy matters as much as the technical plumbing. Rather than nesting groups haphazardly, design a structure that mirrors how the business actually operates — by department, by site such as Parramatta, Adelaide CBD or the Gold Coast, and by role. AirWatch can later filter on these groups, so a clear hierarchy reduces the risk of accidentally enrolling personal devices or former staff. It also helps when responding to requests from the Office of the Australian Information Commissioner, because documented group logic demonstrates that access decisions are systematic rather than ad hoc.
Time synchronisation is another small but critical detail. Domain controllers, AirWatch connectors and any intermediate jump boxes should all point to a reliable NTP source, ideally the public pool servers or an internal stratum-one host. Without it, Kerberos tickets fail, LDAP binds intermittently break, and synchronisation logs become misleading.
Configuring LDAP integration in AirWatch
Once the directory is ready, the integration itself begins in the AirWatch admin portal under System > Enterprise Integration > Directory Services. The setup wizard prompts for the directory type, the host names of one or more domain controllers, the bind account distinguished name, and the search base that defines which user objects AirWatch is allowed to see. In multi-domain Australian forests — common in universities and state government departments — multiple search bases may be required, and the wizard accommodates that by allowing additional configurations to be saved side by side.
SSL or StartTLS should be enabled from the start. Even though the initial test button might succeed over plain LDAP, production traffic must be encrypted, particularly when the connector traverses a WAN link between, say, a data centre in Mascot and a regional office in Hobart. The Australian Cyber Security Centre's Essential Eight guidance treats encryption of administrative protocols as a baseline expectation, and unencrypted directory sync would not survive a review.
After the connection test returns green, schedule the sync. Most organisations start with a daily full sync and a faster incremental interval of fifteen to thirty minutes. For industries with high staff turnover — hospitality groups along the Surf Coast, mining contractors in the Pilbara, retail operations during holiday seasons — shorter intervals reduce the window in which a terminated employee still has access to managed resources.
Choosing the right sync approach
Different environments call for different synchronisation strategies, and the table below compares the three most common options available in AirWatch for pulling users from Active Directory. The right choice depends on directory size, network topology and how much local control the IT team wants to retain.
| Sync Method | Best Suited For | Traffic Direction | Authentication | Typical Sync Interval |
|---|---|---|---|---|
| Direct LDAP over VPN | Single-region deployments with stable WAN | AirWatch appliance queries DCs | Service account bind | 15 min – 24 hours |
| Cloud Connector with outbound HTTPS | Multi-region or hybrid cloud estates | Connector initiates outbound to DCs and to AirWatch cloud | Certificate + service account | 5 – 60 minutes |
| Entra ID Connect bridge | Organisations already syncing AD to Azure AD | AirWatch queries Microsoft Graph | Modern auth via OAuth | Near real-time |
For most Australian mid-market customers, the Cloud Connector strikes a sensible balance. It avoids opening inbound LDAP ports through firewalls — a frequent sticking point for teams working under the Australian Signals Directorate's network segmentation guidance — while still giving administrators control over which attributes are synced. Larger enterprises already running Entra ID Connect for Microsoft 365 often take the bridged route, since it dovetails with existing identity governance investments.
Setting up group-based synchronisation rules
Synchronising every object in the directory is rarely desirable. Group-based rules let administrators decide precisely which users, devices and memberships flow into AirWatch. Create dedicated security groups such as EMM-Corporate-iOS, EMM-BYOD-Android, or EMM-Field-Engineers-WA and populate them with the relevant user accounts. AirWatch can then be configured to sync only members of those groups, which simplifies reporting and keeps the console uncluttered.
Membership criteria can also be built using LDAP filters. A common Australian pattern is to filter on the userAccountControl attribute to exclude disabled accounts, or to use the physicalDeliveryOfficeName attribute to separate Sydney CBD staff from those based in Wollongong or Geelong. When paired with group rules, these filters deliver a precise, auditable cohort that maps neatly onto departmental cost centres.
It is worth applying the principle of least privilege here too. Service desk staff in regional offices should not need full read access to every attribute; scoped roles within AirWatch limit what each operator can see and change. This aligns with Australian Privacy Principle 6, which requires that personal information be used only for the purpose for which it was collected, and it gives the security team something concrete to point to during an internal audit.
Managing authentication and single sign-on
User synchronisation sets the stage, but the end-user experience hinges on authentication. With directory data flowing into AirWatch, organisations can layer on SAML or WS-Federation against an identity provider such as ADFS, Okta or Microsoft Entra ID. Single sign-on means an employee in a Brisbane call centre signs into their corporate laptop once and then moves seamlessly between the management portal, the company intranet and managed applications without retyping credentials.
Conditional access policies tighten this further. Devices that fall out of compliance — for example, a tablet that has not checked in for fourteen days — can be blocked from retrieving email, while devices connecting from unfamiliar networks in Darwin or Cairns can be challenged for multi-factor authentication. These policies reference the same group memberships that drive synchronisation, so the rule that enrols a user is also the rule that governs what they can reach.
Administrators exploring Windows side-by-side management frequently consult Windows UEM integration references to complement the directory work and address how the synced identity is actually consumed on the device itself.
Troubleshooting and ongoing maintenance
Even a well-planned integration will throw the occasional curve. Kerberos ticket expiry, replication latency between sites, and stale service account passwords are the most common causes of silent failures. AirWatch surfaces these through its system events and sync logs, and a short routine — checking Event Viewer on the connector host, validating the bind account password, and confirming DNS resolution of domain controllers — usually isolates the cause within minutes.
Quarterly reviews keep the integration healthy. Verify that the service account is still password-rotation compliant, confirm that group memberships reflect current organisational structures, and check that any new domain controllers have been added to the connector's host list. Australian organisations subject to the Security of Critical Infrastructure Act or sector-specific regulators should also retain evidence of these reviews, as the documentation helps demonstrate ongoing compliance posture.
Finally, test the offboarding path. Remove a test user from the relevant security group, wait for the next incremental sync, and confirm that access to managed applications is revoked. A reliable exit process is the truest measure of whether the integration is doing its job, and it is the area where many otherwise competent configurations quietly fall short.
Ready to take the next step? Start a fully functional 30-day free trial of the AirWatch platform, compare pricing and package options side by side, or speak directly with the Australian sales team to map the integration onto your existing identity estate.