Transitioning from AirWatch Classic to Workspace ONE UEM
AirWatch established the foundations of enterprise mobility management for thousands of organisations, but the platform has evolved significantly since VMware brought it into the Workspace ONE portfolio. The modern Workspace ONE UEM service combines device management with identity, application delivery, endpoint security and digital employee experience capabilities.
Moving from the Classic console to Workspace ONE UEM is therefore more than a change of screen design. It is an opportunity to review enrolment methods, compliance rules, application assignments, authentication, reporting and support processes before placing them in a more integrated operating model.
Australian organisations also need to account for privacy obligations, dispersed workforces and varying network conditions. A migration designed for a head office in Sydney may need different controls for staff in regional Queensland, Western Australia or remote sites with limited connectivity.
| Area | AirWatch Classic approach | Workspace ONE UEM approach |
|---|---|---|
| Administration | Traditional AirWatch console and group structures | Modern UEM console with broader endpoint and identity integrations |
| Device coverage | Strong mobile device management, especially for smartphones and tablets | Mobile, Windows, macOS, rugged, shared and other supported endpoints |
| Application delivery | Profiles, applications and smart groups | More flexible assignment, lifecycle and access controls |
| Security | Device compliance and restrictions | Compliance linked with access, identity and risk signals |
| User experience | Separate management and support workflows | Unified administration with digital employee experience options |
| Migration focus | Existing profiles and enrolments | Data review, policy redesign, staged onboarding and validation |
Why the platform transition matters
AirWatch Classic environments often contain years of accumulated configuration. Profiles may have been created for a temporary project, old applications may still be assigned to inactive smart groups, and naming conventions can vary between departments. Copying every existing object into the newer environment can preserve clutter and create conflicting policies.
Workspace ONE UEM provides a wider endpoint management framework. Alongside iOS, iPadOS and Android administration, many organisations use it to manage Windows and macOS devices, distribute software, enforce encryption and support corporate-owned or personally owned equipment. The right design depends on the organisation’s device fleet rather than on a direct one-for-one recreation of the old console.
The change also affects security architecture. Workspace ONE UEM can work with identity services, conditional access, certificate authorities, secure email and endpoint protection tools. An Australian financial services firm, for example, may use compliance status as part of access decisions for staff in Melbourne while applying stricter controls to privileged administrators working from Sydney or Brisbane.
A transition is most valuable when it produces a cleaner management model. Review the business purpose of each profile, application, restriction and compliance rule. Retire duplicate configurations, document exceptions and define which controls should be global, department-specific or limited to a particular device ownership model.
Preparing the tenant and migration scope
Begin with an inventory. Record every organisation group, enrolment programme, smart group, profile, compliance policy, application, certificate, integration and administrator role. Include devices that appear inactive but may belong to employees on extended leave, field workers or shared operational teams.
The inventory should separate what must be retained from what can be redesigned. A device restriction linked to an obsolete operating system may have no place in the new configuration, while a certificate profile supporting a clinical or logistics application may be business-critical. Confirm ownership with application, security and workplace technology teams rather than relying on console activity alone.
Check the current Workspace ONE UEM tenant, licensing model and supported migration path with the authorised VMware or Workspace ONE representative. Some environments can use migration utilities or structured export and import processes, while others require staged re-enrolment. Data, certificates, application binaries and integrations may have different handling requirements.
Australian privacy requirements should be included in this assessment. The Privacy Act and Australian Privacy Principles influence how personal information, device identifiers and support records are handled. Organisations covered by the Notifiable Data Breaches scheme should also confirm how an enrolment error or exposed device record would be investigated and reported.
Designing enrolment and ownership rules
A clear ownership model makes the new environment easier to operate. Corporate-owned devices may receive stronger restrictions, automatic application installation and remote wipe controls. BYOD devices generally need a more limited privacy-conscious approach, such as managed applications, selective removal of business data and clear separation between personal and corporate information.
Apple Business Manager and Android Enterprise can simplify automated enrolment and application distribution. Windows Autopilot may support a more consistent provisioning process for new laptops. These services should be configured and tested before a broad rollout, including account assignment, device naming, application installation and recovery procedures.
Shared devices need their own design. Warehouses around Brisbane, transport operations near Perth and retail teams across New South Wales may use tablets that change hands throughout the day. Consider shared-user sign-in, local data storage, kiosk restrictions, battery management and a rapid reset process rather than applying a standard employee profile.
Connectivity is another practical consideration. A device used on a mine site, agricultural property or regional health service may not contact the UEM service as reliably as a laptop in a Sydney office. Policies should allow enough time for check-in, provide useful offline behaviour and avoid making critical work impossible during a temporary network outage.
Testing policies, applications and integrations
Build a pilot group that reflects real operating conditions. Include iPhone and Android users, Windows and Mac users, executives, frontline workers, contractors, BYOD participants and shared devices. Test staff from different offices, including a metropolitan location and at least one regional or remote site where network performance differs.
Validate the complete user journey, from enrolment and authentication through application access, compliance evaluation and support. Check whether certificates install correctly, email synchronises, Wi-Fi and VPN profiles behave as expected, and required applications receive the correct configuration. Confirm that removing a device removes only the intended corporate content.
Application testing deserves particular attention. Older line-of-business apps may depend on device identifiers, legacy authentication or a specific managed configuration. Test mobile applications distributed through public stores as well as internally developed packages. For Android, confirm managed configuration values and work profile behaviour; for Apple devices, check supervised mode and Automated Device Enrolment settings.
Use a formal acceptance record for each scenario. Capture the device type, operating system, user group, policy result, application status and support outcome. Resolve high-impact failures before the next wave rather than allowing help desk staff to compensate for an incomplete configuration.
Managing rollout, support and governance
A staged rollout is usually safer than moving every endpoint during a single change window. Start with IT and a small business group, then expand to departments with different applications and work patterns. Keep the Classic environment available for reference during the transition, but define a firm point at which it becomes read-only or is decommissioned.
Communications should explain what employees will see and what they need to do. Staff may need to install an updated Intelligent Hub application, approve a management prompt, sign in again or accept new privacy information. Use plain Australian English and provide separate instructions for corporate-owned devices, BYOD and shared equipment.
Service desk preparation is essential. Create scripts for enrolment failures, lost devices, passcode issues, application delays and compliance messages. Establish escalation routes for identity, certificate, network and application problems. If support is delivered across Sydney, Melbourne, Adelaide and Perth, account for time-zone differences and handovers between local teams.
Governance should continue after migration. Review administrator access, audit logs, policy exceptions, application ownership and compliance reporting on a scheduled basis. Align the UEM service with broader controls such as the Australian Cyber Security Centre’s Essential Eight where relevant, particularly patching, application control, multi-factor authentication and restricted administrative privileges.
Measuring a successful transition
A completed enrolment count is useful, but it does not prove that the new environment works well. Track enrolment success rates, time to provision a device, application installation failures, compliance exceptions, help desk contacts and time taken to resolve incidents. Compare results across operating systems and locations.
Security metrics should cover encryption status, unsupported operating systems, inactive devices, unmanaged access attempts and certificate expiry. Privacy metrics can include the number of BYOD devices, selective-wipe events and support records containing personal information. Keep retention periods and access permissions aligned with internal policy and applicable Australian obligations.
User experience data adds another perspective. Workspace ONE UEM can support broader visibility into device health and application performance, helping teams identify recurring problems before they become widespread. A spike in failed check-ins from regional users may indicate a connectivity issue rather than a policy failure.
Once the rollout stabilises, document the final architecture and ownership of each integration. Schedule reviews for operating-system releases, new device models, application changes and licence adjustments. This turns the migration into a repeatable endpoint management process rather than a one-off technology project.
Start by auditing your current AirWatch configuration, identifying obsolete policies and mapping each device group to a future Workspace ONE UEM design. Use a controlled pilot, validate Australian privacy and operational requirements, and involve your Workspace ONE specialist or sales team early to confirm migration options, licensing and the fully functional 30-day trial where appropriate.