How difficult is it to integrate ISE and Airwatch?

[GeraldFuchs55254]

Hi, We have ISE as well as Airwatch running. Up to know, we have to register all Mobile Devices manually into ISE. They are already setup in Airwatch.  I was told to automate this process , so that Airwatch can register them automatically in ISE is a complicated process. 

Can anyone comment on the complexity of the process, to skip the manual process?

thanks

[paul · Accepted solution]

The links for Airwatch/Workspace ONE integration are pretty dated, but the integration is pretty straight forward.  Setup an account in Airwatch that ISE can use to pull information and then define Airwatch into ISE.  At that point you can start using the MDM dictionary attributes. 

Note that you will need to have APEX licenses as all devices hitting rules with MDM attributes will consume an APEX license. 

Most of my customers don't do the full MDM integration.  If the main question you are trying to answer is "Is this a corporate MDM managed device?" then you can get Airwatch to push a certificate/private key from the customer CA and use that certificate to authenticate the device.  The only way the device should be able to get a cert/private key from the customer CA is through MDM registration.  The presence of the cert indicates MDM registration.

If you need to do compliance checking then you need to do the full integration, but most of my customers don't require that.