Learning AirWatch

5 (1 reviews total)
By Mark Dunkerley
    What do you get with a Packt Subscription?

  • Instant access to this title and 7,500+ eBooks & Videos
  • Constantly updated with 100+ new titles each month
  • Breadth and depth in over 1,000+ technologies
  1. Free Chapter
    Getting Started

About this book

Nowadays, organizations are facing a critical challenge of providing reliable, efficient, and secure access to corporate information. With AirWatch by VMware's Enterprise Mobility Management platform, you will be able to set up and deploy access to corporate information securely from mobile devices, allowing security policies and regulations to meet compliance for your business.

This book will guide you through a detailed overview on how to set up AirWatch by VMware, administer the deployment, manage enterprise integrations, and configure security controls and many more options available for effective EMM deployments in enterprises. Each of the components of EMM is explained in the book in a way that you can apply your knowledge in the best possible manner while working with your mobile deployments.

Publication date:
March 2015


Chapter 1. Getting Started

As you read through the chapters, you will get a full understanding of all the tools included in Enterprise Mobility Management (EMM) with AirWatch by VMware's mobile management suite. We will go through each of the toolsets available to ensure that you understand what is available and how to set up and configure each of them. The intention of this book is not to dive into extreme detail of AirWatch's EMM but to give you the knowledge needed to understand, represent, and set up the configurations. Understand that the mobile space is an extremely fast-growing market and some of the information might have already been updated. The information presented in this book is current as of AirWatch 7.3.

In this chapter, we will take a look at what is needed to get started with AirWatch; we will explore the different licensing options and what hosting methods are available with support. We will also look at the different types of devices that are supported along with the different profile options to manage the devices. Toward the end of the chapter, we will look at setting up the environment in preparation for the following chapters.

The following will be covered in this chapter:

  • An overview of AirWatch

  • Management suite options

  • Hosting options

  • Support options

  • Learning and deployment services

  • Supported devices

  • Device ownership

  • Setting up your environment


An overview of AirWatch

AirWatch is based in Atlanta, USA, with offices worldwide. AirWatch has a presence in more than 150 countries, providing usability in 17 different languages. They were founded in 2003 and began their journey with the management of wireless and rugged devices. Today, AirWatch has been recognized by Gartner as the current leader in EMM. In 2014, AirWatch was acquired by VMware, the industry leader in virtualization software for $1.54 billion.

As an EMM platform, AirWatch has built its solutions to support organizations with its mobility deployments and strategies with ease of use and security in mind. With AirWatch's EMM platform, you will be able to implement (depending on the license) the following components:

  • Mobile Device Management

  • Workspace Management through containerization

  • Mobile Application Management

  • Mobile Content Management

  • Mobile Email Management

  • Secure Browser Management

  • Enterprise File Synchronization and Sharing

  • Multiuser Management

  • Laptop Management

  • Profiles for personal (BYOD)/corporate-owned/shared devices

  • Mobile Security

  • Enterprise Integration

  • Application store

  • Full inventory of all mobile assets

  • Management portal

Understanding and implementing these components will allow you to provide corporate information to your work environment. This will allow employees to become more efficient in what they do best, whether it's an executive who is able to retrieve and modify documents securely on their personal device, a pilot who now has their flight plan always up to date contained within a mobile device, or a physician who is able to access patient information securely from their mobile device. These are just a few examples of the power of EMM and the opportunities available with AirWatch and its fully integrated, single pane of glass solution.


Visit http://www.air-watch.com/ for additional information.


Management suite options

Before you get started with your AirWatch deployment, you will need to decide and select which suite you will implement. AirWatch currently has its management structure broken down into four different color suites: Green, Orange, Blue, and Yellow. Each of these suites offer different features depending on what your organization is looking to deploy with EMM.

The following is a breakdown of each Management Suite:


In the previous figure:

*AirWatch MDM includes native e-mail management with PowerShell integration.

**AirWatch Inbox includes AirWatch SEG.

+AirWatch App Wrapping includes AirWatch Tunnel (iOS only).

++AirWatch Secure Content Locker Collaborate includes AirWatch Secure Content Locker View.

The preceding information was extracted from AirWatch's website at the time of this writing. Review and validate any changes to their suites by visiting http://www.air-watch.com/pricing.

Depending on your mobile strategy and current initiatives, your organization is working on with mobility will depend on which suite to start with. Here is a quick summary of the possible usages of each management suite:

  • Green Management Suite:

    • This will be sufficient for those organizations that own all corporate assets

    • For Bring Your Own Device (BYOD) initiatives, this suite could create security and legal concerns


    Chapter 4, Mobile Security, Chapter 5, Mobile Device Management, and Chapter 6, Workspace Management discuss further the security and legal concerns with BYOD.

  • Orange Management Suite:

    • This will be sufficient for those organizations with BYOD-only e-mail deployments to provide e-mail security with SEG

    • This suite will not provide protection to attachments without the Secure Content Locker (SCL) unless you prevent attachments being delivered to the mobile device

  • Blue Management Suite:

    • This will most likely be the suite needed for most organizations in order to deliver corporate content with BYOD and meet security requirements

    • This will allow for full functionality over all features with the exception of the edit feature within SCL

    • SCL will allow for full attachment control within e-mail and access to other repositories

    • This has enhanced app features to build on application initiatives

  • Yellow Management Suite

    • This includes the ability to modify documents within SCL

    • This adds the ability to provide EFSS as a service to the users

  • The chat and video add-on

    • These are the latest features that provide the chat and video functionality with your EMM deployment

You might also have a need to implement multiple suites within your environment to save costs. For example, you might only want to deploy the Green suite for all your corporate-owned assets and the Blue suite for your BYOD deployment. By identifying the business needs and aligning with the mobile strategy, you will be able to select the Management suite that best meets your needs as an organization.


Hosting options

AirWatch currently has both on-premise and cloud offerings for your organization. Making the decision of hosting AirWatch in the cloud or on-premise will be purely determined by your organization's stance on cloud services. There is no difference between the services offered in the cloud or on-premise with AirWatch.


On premise, the infrastructure will be needed for enterprise integrations whether you are in the cloud or not.

As we have all witnessed over the past few years, there has been a tremendous growth in cloud offerings. This isn't any different with AirWatch and as with many other organizations, AirWatch provides the option of using the cloud to host your EMM suite, also known as their Software as a Service (SaaS) offering.

There are a lot of questions regarding migration to cloud environments with security and data privacy and the concerns with the possibility of technical positions being eliminated. For the security concerns, hosting companies are providing the encryption and controls to meet organizations security requirements. For the most part, I'd imagine enterprise-grade cloud services are providing more than what you are able to provide on-premise, including the latest hardware and software with both physical and software security in place along with high availability and disaster recovery. With an AirWatch SaaS deployment, you are only storing the device information in the cloud environment and there is no corporate data being stored in the cloud, thus providing less risk with using that environment.

For the technical personnel concerns, there will be a change, but it doesn't necessarily mean positions being eliminated. Traditionally as technicians, we tend to spend most of our time dealing with installations, upgrades, patches, and failures of the services (both hardware and software). Because of this, our positions have become more of an operational role, taking the focus away from the service being provided and being able to improve on these services for the customers. Now that we are able to offload the heavy burden of our everyday jobs, we can focus more on the solutions/integrations with the product, allowing us the ability to provide a more service-oriented workforce and better user experience. Also, the mobile space is currently an extremely fast-growing area and won't slow down anytime soon. Because of this, eliminating as much management as possible by moving to a cloud environment will also allow us to focus on the end user service and experience, which is what really matters.

By moving to a cloud environment, we are seeing a shift in the structure of teams. Cloud, service, innovative, architecture are some of the names that are starting to appear in team names as we are seeing a shift in the way, as we have traditionally seen Information Technology (IT) move to more of an Information Service (IS) era.

The following is a breakdown of the hosting options provided by AirWatch:

Hosting options


On Premise

You have full control over your deployment, installation, and upgrades.

Cloud SaaS

Shared SaaS

  • The custom URL for an environment setup as redirect

  • Migration between SaaS and on-premise with re-enrollment

  • The environment is automatically upgraded based on the quarterly release schedule

  • Hotfix updates are applied regularly and automatically

Dedicated SaaS

  • The custom URL for environment as setup as CNAME

  • AirWatch Console access by an IP range

  • Migration between SaaS and on-premise with no re-enrollment

  • The environment is upgraded, which requires the customer's approval

  • Hotfix updates applied require the customer's approval


AirWatch is also being provided and packaged by other IT hosting companies as a service.

Now that you have all the information on the Management suite and Hosting options, you can make a decision on what best fits your organization. The licensing cost is dependent on which suite you select and the hosting plan you move forward with. The Cloud offering is subscription based per device annually or subscription based per user (up to three devices) annually. The cost includes the standard hosting. The on-premise solution has an initial per device cost with a perpetual annual maintenance fee at a smaller cost of the initial fee.


For the latest pricing, visit http://www.air-watch.com/pricing.


Support options

AirWatch has significantly improved its support model over the recent years. The following table demonstrates the different support options available for your organization:






myAirWatch (Web Support)


Full access

Full access

Full access


Full access

Full access

Full access


Full access

Full access

Full access

Reactive support

Support channels

Web and phone

Web and phone

Web and phone

Support requests via web




Support requests via phone

10 calls/year



24 x 7 response times for severity 1

Yes (1 hr)

Yes (30 min)

Yes (30 min)

Weekend response times for severity 2

No (5 x 12)

Yes (2 hr)

Yes (2 hr)

Priority queue




Dedicated support line




Number of supported administrators




Root cause analysis for severity 1




Proactive support

Technical account manager




Annual business reviews




Health checks




Road map reviews





In the preceding table, severity 1 incidents requiring 24 x 7 coverage must be submitted via phone, and severity 1 incidents are not counted toward calls. This table was extracted from AirWatch's website at the time of writing this book. Review and validate any changes to their support by visiting http://www.air-watch.com/services/support.

Deciding on your support option entirely depends on the extent of your EMM deployment. If you have a small organization with a minimal deployment in the cloud, you might only need Basic Support model. If you have a large enterprise with an on-premise deployment, you will most likely need to go for the Enterprise Support model to ensure that you are receiving the most responsive support with all the proactive features included.

As stated in the preceding table, myAirWatch is available to all customers with a lot of valuable resources. From this portal, you are able to manage support requests, access training, view product documentation, collaborate via forums, view analytics, search, FAQs, view announcements, download software, access best practices within EMM and more. This portal will help empower you as an administrator with instant access to a lot of valuable information. As a customer, you can access the myAirWatch portal at https://my.air-watch.com.


Learning and deployment services

AirWatch also includes the option of purchasing their services to deploy your implementation. These services are standardized based on Management suite you select or can even be customized to meet your deployment and needs.


To learn more on AirWatch's Professional Services, visit http://www.air-watch.com/services/professional-services.

In 2013, AirWatch created AirWatch Academy. AirWatch Academy is a certification program that provides administrators an avenue to learn and become accredited as an expert in EMM with AirWatch.

AirWatch's Certification program consists of three different levels:

  • Associate Certification

  • Professional Certification

  • Expert Certification

In addition to AirWatch Academy, AirWatch also has its Partner University program to allow AirWatch partners to be fully prepared when it comes to selling, deploying, managing, and supporting the product and solutions.

AirWatch provides opportunities to learn in the following formats:

  • Product documentation including architecture designs, how-to guides, checklists, white papers, and installation guides

  • ASK knowledgebase with a community of experts

  • Live webinars of training, new features, enhancements, and more

  • OnDemand Training that provides recorded sessions of instructor-led classes

  • Instructor-Led Training on-site, at a training center, or online


Visit http://www.air-watch.com/services/training for additional information on training and certification

In order to become accredited by AirWatch, you will be required to take an exam:

  • Questions are focused on real-world examples

  • These are multiple-choice questions

It is extremely important to invest and promote time and money with learning. Learning opportunities provide benefit to both the technician and the organization. Having technicians on staff who fully understand the product they are managing and show the incentive to learn will only help drive a successful deployment and service for the organization.


Supported devices

AirWatch supports a wide array of platforms within its EMM suite. Not only is the platform portfolio limited to phones and tablets, but manageability is also available for rugged devices (Android and Windows mobile), Mac OS, Windows PC, and Apple TV. Let's take a look at all the different supported platforms and the functionality available within each of them:


Manageable Features

Android Version 2.3 or higher

Passcode, Restrictions, Wi-Fi, VPN, Email Settings, Exchange ActiveSync, Application Control, Bookmarks, Credentials, Secure Launcher, Global Proxy, Date/Time, Sound, Display, Advanced (Additional Options), Custom Settings

Apple iOS (Version 4.0 or higher)

Passcode, Restrictions, Wi-Fi, VPN, Email, Exchange ActiveSync, LDAP, CalDAV, Subscribed Calendars, CardDAV, Web Clips, Credentials, SCEP, Global HTTP Proxy, Single App Mode, Content Filter, Managed Domains, Single Sign-On, AirPlay Mirroring, AirPrint, Advanced (Additional Options), Custom Settings

Apple Mac OS X (Version 10.7.0 or higher)

Passcode, Network, VPN, Email, Exchange Web Services, LDAP, CalDAV, CardDAV, Web Clips, Credentials, SCEP, Dock, Restrictions, Parental Controls, Security and Privacy, Login Items, Finder, Accessibility, Printing, Messages, Global HTTP Proxy, Mobility, Managed Domains, Content Filter, AirPlay Mirroring, Custom Settings, Software Update, Directory, Disk Encryption, Login Window, Energy Saver, Time Machine, VMware Fusion

Apple TV (Version 7.0.2)

Restrictions, Wi-Fi, Credentials, Custom Settings

Blackberry (Version 5.0 or higher)

Device, Telecom, Advanced (Additional Options), Custom Settings

Blackberry 10 (Version 10.0.9 or higher)



Custom Attribute

Symbian (Version 3.1+ and S60)

Passcode, Restrictions, Wi-Fi, Exchange ActiveSync, Credentials, Launcher, VPN, Time Sync, Shortcut, Time Zone

Windows Mobile (Version 5.0 or higher including CE 4+)

Passcode, Wi-Fi, Credentials, VPN, Shortcut, Restrictions, Exchange ActiveSync, Launcher, Time Synch, Time Zone

Windows Phone (Version 7.0.0 or higher)


Windows Phone 8 (Version 8.0.9900 or higher)

Passcode, Restrictions, Wi-Fi, VPN, Email, Exchange ActiveSync, Application Control, Assigned Access, Credentials, SCEP, Custom Settings

Windows 8 / 8.1 / RT (Version 8.0 or higher)

Passcode, Wi-Fi, VPN, Credentials, Restrictions, Firewall, Anti-Virus, Encryption, Automatic Updates, Web Clips, Exchange ActiveSync, SCEP, Custom Settings

Windows PC (Version Windows XP 5.1.0 / Windows Vista 6.0.0 / Windows 7 6.1.0)

Wi-Fi, VPN, Credentials, Shortcuts, Exchange Web Services, Encryption, Passcode


Some functionalities might not be available on all platforms as they are provided through traditional MDM APIs provided by the operating system.


Device ownership

AirWatch has built its enrolment around three types of ownership: corporate dedicated, corporate shared, and employee owned. As you build your mobility initiatives, it's important to align your deployments with the different ownership types from AirWatch. These different types of ownership grant a different level of access to the device. The configurable options available for each of the device ownership are:

  • GPS

    • GPS data

  • Telecom

    • Carrier/Country code

    • Roaming status

    • Cellular data usage

    • Call usage

    • SMS usage

  • Applications

    • Personal applications

  • Commands

    • Full wipe

    • File manager access

    • Remote control

    • Registry manager

As stated here, these options are customizable for each of the device ownership types within the administrator console and will most likely be different for each of the ownerships:

  • Corporate – Dedicated:

    • Should be used for devices owned by the organization

    • Will most likely have all options enabled for full access to device

  • Corporate – Shared

    • A device supplied by the organization to also be used personally, which is also known as Corporate Owned Privately Enabled (COPE). An example of this is a corporate phone that is also allowed for personal use.

    • A device supplied by the organization but used by multiple users, which is also known as a Multiuser Device.

    • This will most likely have most options selected with the exception of some to allow some personal privacy but will depend on the policies enforced by the organization.

  • Employee Owned

    • This ownership type will be used for personal devices

    • There shouldn't be any options enabled as the device is personal and can potentially create a conflict with privacy

    • These options will come preconfigured by default but you will want to make sure you set up and document each of the ownership types. For Employee Owned, I recommend that you make this available to users to view as a document or by creating customized Terms of Use for users to read and accept. There will be questions with regard to the ownership type with personal devices. Users are very sensitive with their personal devices and you will at some point be explaining to them exactly what you can see on their devices.


Setting up your environment

Depending on which hosting option you selected, your setup can be as easy as simply logging in with a newly provided user account to the cloud or consist of a lengthy configuration and set up with the on-premise deployment. The following are the requirements needed to get your environment set up based on your choice of deployment:

Shared SaaS

With the SaaS environment, you will have two options for deployment:

  • Pure Cloud

  • Integrated Cloud

The Pure Cloud option will have no integration with any of your enterprise systems. All accounts will be managed locally and there will be limitations on your deployment. This option might serve a purpose for a smaller organization that doesn't have enterprise systems or is just looking for a simple deployment of AirWatch.


If you move forward with this option, there could potentially be a lot of management needed with local accounts that need to be created and deleted.

The Integrated Cloud option or better known across the industry as Hybrid Deployment provides the same SaaS environment for management with the addition of integrations with your enterprise systems using AirWatch Cloud Connector (ACC), Mobile Access Gateway (MAG), and Secure Email Gateway (SEG). These integrations do require on-premise deployment of servers, which will be covered in Chapter 3, Enterprise Integration, and Chapter 7, Mobile Email Management.

With both of these options, getting started is easy. You will be provided with the URL to your environment and login details to gain access. Your URL will look something like https://cnxxx.awmdm.com, where xxx will be replaced with a number. Once you have this information and your login details, you are ready to start.


You can set up your own custom URL that is redirected to your SaaS environment.

Dedicated SaaS

The dedicated SaaS environment follows the same options as mentioned previously with the exception of the differences listed in the table present in the Hosting options section of this chapter. There are a few reasons to select this option but the primary reason is to gain more control over when updates and Feature Packs can be deployed.

To get started with your dedicated SaaS, you will be provided with the URL to your environment and login details to gain access. Your URL will look something like https://cnxxx.awmdm.com, where xxx will be replaced with a number. Once you have this information and your login details, you are ready to start.


You can set up your own custom URL using a CNAME DNS record. The recommended configuration is to set up your CNAME record to point to the AirWatch CNAME record, which will direct to the AirWatch Host A record. The reason for this is to allow AirWatch to gain control over where the records point in the event of a failover. If you point your CNAME record directly to the AirWatch Host A record, you will delay the time of a failover, as you will be required to update your DNS records.

On-premise appliance

As an alternative to setting up and configuring your on-premise deployment, AirWatch provides us with the opportunity to use an appliance. The appliance is preconfigured by AirWatch, shipped to the customer ready to simply deploy in the network and turn on.

The following is the sizing chart provided by AirWatch:

Max number of devices






Number of appliances






CPU cores












Hard disk (GB)







The following are important to know as part of the appliance deployment:

  • It is not recommended to enroll more devices than stated per configuration

  • Windows server and SQL licenses are included with the appliance

  • You will need multiple appliances and your own load balanced solution to provided HA/Failover

On-premise deployment

The last option is the on-premise deployment, that is, giving the customer full control and flexibility over the deployment. This option will require a lot of planning and involvement from multiple teams in order to make it successful.

Since this book is focused more around learning AirWatch, I will not go into deep detail on all the different architecture and options with setting up AirWatch, as this information can easily present itself in its own book. Instead, I will give a high-level overview of the options and requirements to get AirWatch set up.

Before you get started with your on-premise deployment, you will need to fully review the architecture and pre-installation documents provided by AirWatch. You will need to size your environment correctly based on the number of devices you plan to enroll plus future growth.

For the setup and configuration, you will need to involve multiple technical teams with the deployment:

  • The Application/Mobility team (Application owner of AirWatch)

  • The Database team (SQL database installation and management)

  • The Systems management team (provide servers and monitoring)

  • The Storage team (provide all storage requirements)

  • The Network team (provide Firewall changes, HLB, and other network changes)

  • The Security team (validated configurations meet security needs)


For your on-premise deployment, there are three required components:

  • AirWatch Admin Console: This is the web console used by administrators to set up, configure, and manage devices

  • Device services: This component allows AirWatch to communicate with the devices

  • SQL database: All AirWatch information is contained within the SQL database

In addition to the required components, there are several optional components:

  • AirWatch SEG: Allows greater integration, control, and security with enterprise e-mail systems. This will be covered in detail in Chapter 7, Mobile Email Management.

  • AirWatch Cloud Messaging (AWCM): AWCM allows AirWatch to directly send commands to Android, Symbian, and Windows mobile devices and push products to PCs and Mac OS X. This allows the elimination of Google Cloud Messaging (GCM) for Android devices and reduces security concerns by eliminating communication over public networks.

  • AirWatch Cloud Connector (ACC): ACC provides enterprise integrations with multiple different components within the network. This will be covered in more detail in Chapter 3, Enterprise Integration.

  • AirWatch Mobile Access Gateway (MAG): MAG allows secure integration with enterprise applications and sites and content repositories. This will be covered in more detail in Chapter 3, Enterprise Integration; Chapter 8, Mobile Content Management; and Chapter 9, Mobile Application and Mobile Browser Management.

  • AirWatch App Wrapping: This allows an organization to add additional security and data loss prevention by wrapping the applications before deployment. This will be covered in more detail in Chapter 9, Mobile Application and Mobile Browser Management.


There are multiple configurations available with all the different components provided by AirWatch. In summary, the following configurations are provided as examples from AirWatch:

  • Basic/Single Application Server Deployment

    • This is recommended for managing less than 1,000 devices

    • This includes all the components on a single server

    • This allows simplified installation, configuration, and integration

  • Hybrid Server Deployment

    • This is recommended for managing between 1,000 and 5,000 devices but can be used for less if desired

    • This solution combines only the Admin console, AWCM and Device Services components onto one server

    • Dedicated server for SQL database

    • Dedicated server for SEG and other optional components


      Plan to deploy the application server within a DMZ if possible for additional security.

  • Multiple Server Deployment

    • This is recommended for managing more than 5,000 devices but can be used for less if desired

    • This solution allows the deployment of components on their own dedicated servers

    • Provides greater security by deploying specific components within the DMZ and others on internal network


Because of the complexity and requirements for this deployment, it is recommended to work with AirWatch on the architecture and configuration.


The following tables will give you an idea of the hardware requirements needed for your on-premise deployment:

Application server

Max number of devices








Admin Console

1 standard app server for all roles

Virtual Machine / 2 CPUs / 4 GB RAM

1 app server per 50 concurrent admins

Device Services

1 app server

2 app servers

Device Services with AWCM

1 app server

2 app servers

Database server

Max number of devices








CPU cores
















DB size(GB)








Trans log size(GB) (Log backups every 15 minutes)








Temp DB (GB)








Avg IOPS (DB and temp DB)








Peak IOPS (DB and temp DB)









There are also minimum requirements and deployment architecture for 50,000 or more devices that can be provided by AirWatch.

Console and device services connectivity prerequisites

Before you can get started with the installation of the console and the device services connectivity server(s), you need to meet all the prerequisites. The following is a breakdown of what is needed before you can start the installation:

The hardware requirements are as follows:

  • A VM or physical server

The general requirements are as follows:

  • Remote access to Windows servers

  • Notepad++ (recommended)

  • Firefox or Chrome (recommended)

  • Service accounts for authentication to enterprise systems

  • Test devices (iOS, Android, Windows Phone 8)

  • Corporate Apple ID—if your deployment includes iOS devices, you will need to generate Apple APNs certificate, which is available at https://appleid.apple.com

  • Corporate Google ID—this is required to search Play Store and push applications to the devices

The software requirements are as follows:

  • Externally and internally registered DNS (public IP addresses)

  • SSL Certificate from trusted third party with Subject or Subject Alternative Name (SAN) of Domain Name System (DNS)

  • Windows Server 2008 R2 or 2012 or 2012 R2

  • Installation of IIS Role with the following services from Server Manager:

    • Common HTTP features: Static Content, Default Document, Directory Browsing, HTTP Errors, HTTP Redirection

    • Application development: ASP.NET, .NET Extensibility, ASP, ISAPI Extensions, ISAPI Filters, Server Side Includes (SSI)

    • Health and diagnostics: HTTP Logging, Logging Tools, Request Monitor, Tracing Security: Request Filtering, IP, and Domain Restrictions

    • Performance: Static content compression, dynamic content compression

    • Management tools: IIS Management Console, IIS 6 Metabase Compatibility


    Note that Ensure WebDAV is not installed.

  • Installation of the following features from Server Manager:

    • .NET Framework 3.5.1 features: Entire module(.NET Framework 3.5.1, WCF activation)

    • Message queuing: Message Queuing server

    • Telnet client

  • Installation of 64-bit Java Runtime Version 7 or higher

  • IIS 443 binding with the same SSL certificate (device services only)

  • Installation of .NET Framework 4.0

  • Microsoft URL Rewrite Module 2.0


Additional proxy software might be required for communication to Apple devices, App Store, and Google Play Store.

The database and reporting services requirements:

  • SQL Server 2008 R2 or 2012 running in the 2008 compatibility mode

  • Creation of AirWatch database

  • SQL collation is SQL_Latin1_General_CP1_Cl_AS

  • SQL account permissions:

    • db_owner on the AirWatch database

    • db_datareader, public, and SQLAgentUserRole on MSDB

  • Ensure Full-Text Search is installed on SQL database

  • Reporting services installed and configured in SQL Management Studio

  • Reporting services configured with user, password, and database

  • Validate SQL account permissions:

    • db_owner on the ReportServer<Instance> database

    • db_owner on the ReportServerTempDB<Instance> database

  • Validate that the Web services URL is reachable

  • Validate that the Report Manager URL is reachable

  • Validate that the Web services URL is reachable from Console server

The network requirements are as follows:

There are multiple ports that need to be opened on your corporate firewall in order to allow AirWatch to work correctly. The following will need access to internal and/or external Internet resources:

  • Admin console server

  • Device services server

  • SQL server reporting

  • Devices (Internet/Wi-Fi)

  • Apache Tomcat server


You will need to work closely with your network team to ensure that all the ports on the firewall are opened correctly. There is over four pages of protocol/port configurations to multiple external URLs needed. The required protocol/port configurations can be found in AirWatch On-premise technical architecture guide.

It is highly recommended to implement redundancy with a load balancer. These configurations should be implemented: Round Robin, Session Persistence for Device Services, and Admin Console and redirect all HTTP requests to HTTPS.

The preinstallation check

After implementing all the requirements, you can use AirWatch's preinstallation tool to validate that your on-premise environment is ready to install AirWatch Application server. Once the tool is open, select Application Server and then follow the instructions to validate. You will be presented with the results and what needs to be resolved if there is anything.

Once you have everything set up correctly, you will be ready to install your environment. AirWatch will provide you with the necessary installation files and services to get your environment up and running on premise.

Deploying AirWatch On-premise will require a lot of preparation and planning, which will require a dedicated senior-level architect/engineer to fully understand the complexities and requirements needed to set up the environment. Unless your organization has a no-cloud policy, it is highly recommended to move forward with a SaaS deployment to allow your teams to focus more on the services being delivered and more importantly, a successful mobile strategy.



In this chapter, you learned about AirWatch and their product portfolio with mobility. The mobile industry has moved towards an EMM solution. Moving forward with one EMM will allow organizations to simplify their mobile strategy and create more efficient solutions for the end users.

We looked at the different management suite options provided by AirWatch; whether you would need all features or just some depends on the scope of your deployment and the needs of your initiatives. There are different options to host your AirWatch environment, of which SaaS is a popular option. We also looked at the support, learning, and deployment services available from AirWatch and the different options available with each of them.

We also looked at the supported devices within AirWatch along with the different ownership types that devices can be enrolled as (corporate dedicated, corporate shared, and employee owned). To finish the chapter, we reviewed the requirements for setting up the AirWatch environment depending on your deployment type. This leads us to the next chapter, which demonstrates how to access and manage the AirWatch environment once set up.

About the Author

  • Mark Dunkerley

    Mark Dunkerley is currently the manager of messaging, mobile, and video services at the Adventist Health System. He was born in Newcastle upon Tyne, England and currently resides in Orlando, Florida. He holds a bachelor's degree of science in business administration and a master's in business administration.

    He has worked in the technology field for over 12 years and has experience in several technical areas. He has earned certifications from AirWatch, Microsoft, CompTIA, VMware, AXELOS, Cisco, and EMC.

    Mark is currently involved with unified communication and mobility strategies and deployments in his current role. He recently spoke at several conferences for AirWatch and Microsoft and published several case studies. To view more information on the work Mark has done, you can visit his LinkedIn profile at www.linkedin.com/in/markdunkerley.

    Browse publications by this author

Latest Reviews

(1 reviews total)
Learning AirWatch
Unlock this book and the full library FREE for 7 days
Start now