Set up AirWatch for Chromebook fleet management
Chromebooks are increasingly common in Australian schools, government offices and businesses with hybrid teams in Sydney, Melbourne, Brisbane and regional centres. Their portability suits customers who move between offices, home networks and public Wi-Fi, but a dispersed fleet also creates challenges around enrollment, application access, security and device support.
Effective management requires a clear division between Google’s ChromeOS controls and AirWatch’s enterprise mobility capabilities, now delivered through VMware Workspace ONE. The following setup process explains how to set up AirWatch for Chromebook management while preserving a reliable identity source, consistent policies and a defensible privacy approach.
Prepare the Google and VMware foundations
ChromeOS and VMware should complement rather than duplicate each other. Google handles core ChromeOS administration, while AirWatch adds organisational context for identity, applications, conditional access and endpoint visibility.
| Management need | Google Admin console | AirWatch or Workspace ONE | Recommended operating model |
|---|---|---|---|
| Browser and ChromeOS settings | Native Chrome and ChromeOS policies | Controls exposed through supported Chrome Enterprise integration | Google owns the operating-system baseline |
| Users and groups | Source directory and organisational units | Directory sync, access rules and role-based assignments | Match groups by stable identifiers |
| Device inventory | ChromeOS device records | Mobility, compliance and telemetry context | Combine both views during support |
| Applications | Managed web applications and extensions | App catalogue, access policies and virtual apps | Deliver applications through the corporate catalogue |
| Security decisions | Chrome security and administrator roles | Conditional access, authentication and contextual controls | VMware evaluates access to managed resources |
Confirm the licensing required for your chosen console. An organisation may need VMware Workspace ONE or a current AirWatch entitlement, plus Chrome Enterprise Upgrade, a suitable Chrome Education Upgrade or access to the relevant Chrome Enterprise API. Existing Google Workspace editions also affect which administrative actions are available.
Create named administrator accounts rather than relying on a personal Google account. Give the integration service account only the permissions required for directory and device management, and store OAuth credentials and certificates in an approved secrets vault. Document ownership of each integration so an employee change does not leave the deployment without a working administrator.
Define ownership and device groups
Decide whether each Chromebook is company-owned, employee-owned or part of a bring-your-own-device program. Ownership determines who pays for replacements, who may enrol the device, what support is available and whether company data can be removed during offboarding. A written device agreement should also cover lost devices, accidental damage, repairs and the return of equipment at the end of an engagement.
Create groups based on operational needs rather than personal characteristics. Useful examples include a school’s junior and senior cohorts, customer-service staff, field technicians and executive devices. Location can help organise support, but policy groups should normally follow role, device type and risk. A fleet used by a Melbourne field team may need the same controls as one operated from a Sydney office, despite using different mobile networks.
Use consistent naming conventions for devices, users and enrolment records. Include the organisation, asset number, user or cohort and device type where practical. Map Google groups to the corresponding VMware groups and test the mapping with several users, including one administrator and one person who belongs to multiple groups. Avoid matching solely on display names, which can change or be duplicated.
Connect Google identity and device services
Begin with the current VMware or Google integration documentation for your console version, as menu names and identity requirements can differ between legacy AirWatch deployments and Workspace ONE. The typical flow involves creating a Google service account, authorising OAuth access, entering the resulting credentials into the mobility console and selecting the required directory and Chrome services.
Synchronise the corporate directory before testing device enrolment. Confirm that employees, contractors and service accounts appear correctly, and that group membership is preserved. Where a user has more than one role, VMware should use the appropriate access group without creating a second identity. Contractors who need temporary access should be moved into a restricted group when their engagement ends.
Enrol a small number of test Chromebooks and verify the complete operational path. Check that each device appears with the correct serial number, operating-system version, owner and assigned policy. Open a managed application, test an update and confirm that relevant events reach the mobility console. Enrolment should use the approved corporate workflow rather than a personal Google profile, especially for devices containing school records, health information or commercially sensitive data.
Configure ChromeOS policies and applications
Establish a baseline policy that applies to every managed Chromebook and then add role-specific exceptions. Document which settings are managed through Google and which are enforced through the VMware Chrome Enterprise integration. Competing policy sources can produce inconsistent behaviour, particularly for extensions, proxy settings, developer mode and kiosk configuration.
A sensible baseline restricts developer mode and guest access, enables safe-browsing protections, requires screen locking, limits installation to approved extensions and keeps ChromeOS current. Configure network and proxy requirements for school campuses and corporate sites. Managed bookmarks can support shared portals, while controlled kiosk mode can provide a locked application environment for reception desks, testing benches or warehouse scanning.
Deliver business applications through the managed catalogue. Depending on the application and licensing model, this may include a progressive web app, browser extension, virtual desktop application or links controlled through VMware access policies. Teachers might receive classroom applications and content bookmarks, while finance staff receive additional payment and reporting tools. Test each application with an ordinary account as well as an administrator so that a successful administrator test does not conceal a permission problem.
Protect access, data and Australian operations
Integrate the corporate identity provider with single sign-on and multifactor authentication, then use VMware conditional access to evaluate device posture before granting access to sensitive applications. Rules can require managed-device status, a compliant operating-system version, suitable network context or membership of a particular group. Apply stricter controls to administrative, financial and student-record systems than to low-risk internal resources.
Australian privacy obligations apply when device records or user activity contain personal information. Under the Privacy Act 1988, the Australian Privacy Principles require organisations to be transparent about collection, use and disclosure, keep information relevant, protect it appropriately and provide mechanisms for access and correction. Review what telemetry is retained, establish a deletion schedule, and assess disclosures to overseas VMware or Google infrastructure where services are hosted outside Australia.
The Notifiable Data Breaches scheme and Australian Signals Directorate guidance reinforce the need for tested response processes. Losing a Chromebook on a train or connecting it to untrusted café Wi-Fi should trigger a defined support workflow, not an improvised account reset. Where possible, remotely lock the device, revoke sessions and protect corporate data while preserving evidence needed for an investigation. Staff in roles that travel frequently should also know how to report damage or loss outside normal business hours.
Pilot safeguards for a reliable rollout
Pilot the configuration with a representative cohort before expanding across the fleet. Include different ChromeOS versions, managed and flexible-use devices, and users who work from offices, homes and shared sites. A pilot involving several Australian schools or business units can expose roaming, broadband and mobile-hotspot issues that an office-based test will miss.
- Test a representative device cohort covering different operating-system versions, user roles and working locations, including staff who rely on mobile hotspots outside major cities.
- Publish clear enrolment, ownership, acceptable-use and support guidance before devices enter service, with a channel for reporting loss, damage and account problems.
- Record baseline measures such as enrolment time, policy-compliance failures, application errors and support requests before introducing additional controls.
- Maintain a controlled exception and rollback process so urgent operational needs can be documented without leaving unmanaged devices permanently outside policy.
Review pilot results with IT, security, privacy and the people who support users. Resolve ambiguous policy assignments, correct group mappings and test offboarding before approving the first production wave. Roll out in stages, pausing between groups if compliance falls or support demand becomes excessive. This approach reduces the risk of enrolling hundreds of Chromebooks before basic identity and access problems have been corrected.
Start a controlled 30-day evaluation
Use the fully functional 30-day free trial to test the complete workflow rather than only the console interface. Include Google configuration, directory synchronisation, enrolment, policy assignment, application access, conditional access and reporting. Agree on success measures at the beginning, including the time required to enrol a device and the proportion of users able to access required applications without help.
Review package and pricing options against the device count, support expectations and security requirements during the evaluation. Ask the sales team for pricing and package comparisons, and examine customer stories from organisations with comparable education or enterprise mobility programs. The evaluation should also establish what assistance is available if a connector behaves differently from the documented setup.
Begin with a test group, preserve the validated configuration and expand only after the trial confirms reliable management for Australian operating conditions. Request the 30-day AirWatch trial and contact sales to arrange the appropriate package, deployment planning and technical onboarding for your Chromebook fleet.