Review the information in this section before you begin the upgrade procedure.

Feature Pack Upgrades

If you are performing a feature pack upgrade (for example, from AirWatch v8.0.1 to AirWatch v8.0.3), then refer to the Performing a Feature Pack Update for Workspace ONE UEM appendix. Otherwise, read the system requirements below and then proceed with Prepare for Your Upgrade.

Single Server vs. Multi Server Topologies

In order to streamline the Workspace ONE UEM Upgrade Procedure, the document refers to both Workspace ONE UEM console Servers and Workspace ONE UEM Device Services Servers. Before proceeding, it is important to understand each of these components and what they mean to your specific topology model.

  • The Workspace ONE UEM console Server refers to the component of Workspace ONE UEM that renders and displays the UEM console. It is designed to present and send data to the database directly from the Workspace ONE UEM UI.
  • The Workspace ONE UEM Device Services Server refers to the component of Workspace ONE UEM that communicates with all the managed devices. This server executes all processes involved in receiving and transmitting information from devices to other components of the system. It is the Workspace ONE UEM end-point.

If your instance of Workspace ONE UEM operates on a single application server alongside a database, then both of these components are installed on your individual application server. Wherever this documentation references the Console and Device Services server, simply perform the steps once on your individual application server.

If your instance of Workspace ONE UEM contains multiple application servers, then these two components have been logically separated. In this case, the Workspace ONE UEM Installer will automatically detect which components must be installed on each server without any user input. For each step listed that describes both the Console and Device Services components, complete the procedure on all Workspace ONE UEM servers.

Upgrade Note for Smart Groups

Note that if you have smart groups with over 500 devices when using the Select Devices and Users option for smart groups then you will not be able to upgrade until these groups have been limited to a maximum of 500 individual devices. If you encounter a scenario where you must add more than 500 devices while utilizing the Select Devices or Users option, consider instead enabling the Select Criteria option for that main bulk of devices that share a general criteria and, if required, create multiple Select Devices or User smart groups for those devices that fall outside of the general criteria.

Upgrade Note for AWCM

For customers upgrading from AWCM 4.x (AirWatch v6.4–v7.0) to AWCM 6.x (AirWatch v8.0-9.2) and wanting to use explicit clustering, please refer to the following KB article:

For more information about configuring AWCM clustering, see the VMware AirWatch Installation Guide (VMware provides this documentation to you as part of the on-premises installation process) and the Appendix – Deployment Options section of the AWCM Guide.

Upgrade Note for VMware Enterprise Systems Connector

The VMware Enterprise Systems Connector auto-update feature will not function correctly until your VMware Enterprise Systems Connector server is updated to .NET Framework 4.6.2. The VMware Enterprise Systems Connector auto-update feature will not update the .NET Framework automatically. Please install .NET 4.6.2 manually on the VMware Enterprise Systems Connector server before performing an upgrade.

The VMware Enterprise Systems Connector replaces the AirWatch Cloud Connector.

What about the SEG and VMware Tunnel Servers?

The VMware Tunnel server requires communication with AWCM to authenticate devices. Because of this requirement, end user devices cannot use the VMware Tunnel during the upgrade process. Because the SEG server is an auxiliary component of the Workspace ONE UEM architecture that does not communicate with the Workspace ONE UEM database, it is neither affected by, nor needs to be altered during the Workspace ONE UEM Upgrade process. That said, all devices that communicate through the SEG to receive mail will continue to receive mail during the upgrade, provided that the SEG is installed on its own server. If you are running the SEG on the same server as the UEM console or Workspace ONE UEM Device Services servers, then refer to the notices throughout the guide that contain special instructions regarding the EAS Integration and World Wide Web Publishing services.

Refer to the Workspace ONE UEM Secure Email Gateway (SEG) and VMware Tunnel guides for additional information, which are available on


You can find several troubleshooting knowledge base articles on myAirWatch by executing the search parameter 'Troubleshooting Upgrades' at the following link: The articles you find with this search may help you address issues you encounter during the upgrade.