Seven AirWatch gems hidden in plain sight
For administrators running Workspace ONE Unified Endpoint Management in Australia, the standard training covers console navigation, profile push, and app distribution. What gets missed is the layer underneath: features that sit two menus deep or require reading release notes instead of the quick-start wizard. These buried controls can shave hours off weekly tasks and tighten the security posture for organisations operating under the Notifiable Data Breaches scheme.
Most teams discover them by accident during an incident response drill, or when an auditor from the Australian Cyber Security Centre asks a question that the obvious dashboard cannot answer. The seven practical capabilities below are exactly the ones that keep showing up in those conversations, and they work whether the fleet is based in Sydney, Brisbane, Perth, or a hybrid mix across regional operations.
Smart Groups and dynamic device tagging
Smart Groups in AirWatch are commonly treated as a one-time setup tool — build a group, populate it once, forget about it. The hidden value lies in layering queries and combining user group membership with attributes such as device model, OS version, encryption status, or the office a device usually syncs from. A mining crew in Kalgoorlie logging in via a rugged tablet behaves nothing like a finance team member in a Melbourne CBD office, and a single Smart Group can absorb both patterns with a query like "Owner = Mining AND OS = Android 11+".
Tags take this further. Far beyond the cosmetic stickers they appear as in the console, tags flow into profile payloads, certificate issuance, and even the console audit log. Many admins never realise that a tag applied to a user can drive certificate enrolment through SCEP without any manual approval step. Once that wiring is in place, onboarding and offboarding become near-automatic, which is exactly what HR teams in mid-tier Australian enterprises ask for during seasonal ramp-ups.
Compared with rival Windows UEM tooling, AirWatch's query engine is unusually expressive for a SaaS product, and it scales into the tens of thousands of devices without the queueing delays that show up elsewhere during Monday-morning sync windows.
Compliance policies that fix themselves
Compliance Engine is on by default, but the auto-remediation rules are usually off. Admins tick "Email Profile is missing" and stop there, missing the obvious next step: a single click that pushes the missing profile back down once the flag flips. The same applies to jailbreak status, outdated OS builds, and the App Inventory check that fails when a user has side-loaded a banned application. Each of these can be wired to send the device straight back into a known state without opening a ticket.
The Australian Prudential Regulation Authority's CPS 234 standard, which applies to banks, insurers, and super funds from Sydney to Launceston, leans heavily on this kind of provable enforcement. Showing an auditor that a non-compliant device is quarantined or wiped within minutes — not within the next helpdesk shift — is often the difference between a pass and a finding.
A subtler gem sits in the Actions tab: the ability to email or SMS a user with a custom message once a breach is detected, including localised content for each site. Sydney admins will tell you that the difference between a user opening the SMS at lunchtime and ignoring a Microsoft Teams ping during the afternoon is enough to recover the device within the hour.
Privacy screens and Lost Mode for BYOD
BYOD programs in Australia have grown steadily since the pandemic, particularly among healthcare providers in Adelaide and consultancies that need staff to work from home on Tuesdays and Thursdays. AirWatch supports BYOD enrolment modes that keep personal data private, but the controls are not all bundled into one screen. Privacy screens on iOS, for instance, can suppress work contact search results while still pushing mail and calendar, and Android Enterprise work profiles can hide the work apps drawer entirely when the device is in personal mode.
Lost Mode is usually associated with corporate-locked devices, but admins forget it also works on supervised iOS and corporate-owned Android with a work profile. Triggering it from the console reveals a map pin and a contact phone number; if the device does not check in for thirty days, the admin can issue a remote wipe without ever seeing the user's personal photos or messages.
The third often-missed item is the corporate wipe option. Choose it during enrolment for any user whose contract might end mid-quarter. When HR terminates the account, the work container disappears in the next sync cycle, leaving their personal Gmail, photos, and TikTok downloads untouched. For privacy officers monitoring the Notifiable Data Breaches scheme, that boundary between personal and work data is exactly what the OAIC wants documented.
Tunnel profiles for Per-App VPN
Workspace ONE Tunnel is widely deployed but rarely configured past the default split-tunnel. Admins pushing Tunnel as a device-wide VPN end up with everything routed through the corporate gateway — including personal streaming — which is the fastest way to get user complaints in any Perth or Brisbane office. Per-app VPN wraps only the named applications in the tunnel, so Slack and Salesforce stay encrypted while Spotify stays out of the corporate pipe.
The hidden gem here is the rule engine that lives under "Traffic Filter Rules." You can build allow-lists and deny-lists that match on domain suffix, IP range, or even a regex on the SNI field, and apply those per app, per user group, or per device tag. For organisations concerned about where traffic terminates, paying attention to the underlying data centre equipment that powers regional cloud endpoints can inform capacity and resilience planning before committing to a single egress strategy.
Another quiet feature sits a level deeper: certificate pinning inside the Tunnel client. Most teams accept the default CA bundle and move on, but pinning the corporate root to specific managed apps prevents a compromised device from being used to exfiltrate tokens through a rogue tunnel endpoint. Pair that with a short-lived cert on the Tunnel gateway itself, and the audit story writes itself during the next ACSC inspection.
Reporting that finally answers the hard questions
Out-of-the-box dashboards answer who, what, when. They rarely answer why or how long. The Reports tab contains a Custom Report builder that most admins never open, and inside it sits a query language that feels like a watered-down SQL. Drag in the device compliance history, the certificate serial, and the Smart Group the device sat in at the time of the event, and the report will reproduce a full audit trail in a single CSV ready to hand to a regulator.
Scheduled delivery is the second quiet win. Set a daily or weekly export to land in an admin's inbox, an attachment to a SharePoint list, or even a webhook into a Slack channel. Australian teams working staggered hours across AEST, AWST, and ACST often rely on these scheduled reports to catch regional drift before the morning standup in Sydney starts.
OEM data import is the third. Manufacturers like Samsung, Apple, and Zebra expose warranty, repair, and battery health through their APIs, and AirWatch can ingest that on a schedule. A fleet manager running thousands of rugged scanners across a Pilbara mine site can see the ones about to fail before they fail, which is the kind of foresight that turns a quarterly review into a strategic asset.
The comparison below pulls together the areas where these hidden capabilities most often surface in customer conversations across Australian industries.
| Capability | Where it lives in the console | Typical weekly time saving | Best fit industries in Australia |
|---|---|---|---|
| Smart Groups with tags | Devices > Groups > Smart Groups | 3–5 hours on bulk moves | Mining, retail, education |
| Auto-remediating Compliance | Policy > Compliance > Actions | 2–4 hours on tickets | Banking under APRA CPS 234, government |
| BYOD privacy + Lost Mode | Devices > Profiles > Privacy / Actions | 1–2 hours per offboarding | Healthcare, professional services |
| Per-app Tunnel rules | Apps > Tunnel > Traffic Rules | 1–3 hours on app repackaging | Legal, financial services, NDB-regulated |
| Custom scheduled reports | Reports > Custom Reports | 2–6 hours on audit prep | All sectors, especially during ACSC audits |
A fully functional 30-day free trial of the Workspace ONE UEM suite is the simplest way to put each of these features through its paces against a real Australian workload. During the trial, configure one Smart Group, one auto-remediating policy, one Per-App Tunnel rule, and one Custom Report — that exercise alone will surface which of the seven are worth standardising on, and which can wait until the next quarterly review. Customer stories from Australian banking and mining deployments are worth a read during evaluation, and the sales team can map each gem onto a specific package comparison once the trial results are in.