When setting up users and devices in AirWatch, AirWatch uses organization groups (OG) to organize and group users and to establish permissions. When AirWatch is integrated with VMware Identity Manager, the admin and enrollment user REST API keys can only be configured at the AirWatch organization group of type Customer.
In AirWatch environments configured for multi-tenancy, many organization groups are created for users and devices. Devices become registered or enrolled into an organization group. Organization groups can be set up in unique configurations in a multi-tenancy environment. For example, organization groups by separate geographies, departments, or use cases. In the AirWatch integration page, you add the organization group ID and enter the AirWatch admin API key that is used to make API requests.
You can link domains configured in VMware Identity Manager to specific organization groups in AirWatch to manage device registration through Workspace ONE. When users log in to Workspace ONE, a device registration event is triggered within VMware Identity Manager. During the device registration, a request is sent to AirWatch to pull any applications that the user and device combination is entitled to.
The device organization groups must be identified when AirWatch is integrated with VMware Identity Manager so that identity manager can locate the user and successfully register the device into the appropriate organization group.
When you configure the AirWatch settings in the VMware Identity Manager service, you can enter device organization group IDs and the API keys to map multiple OG to a domain. When users sign in to Workspace ONE from their devices, the user records are verified and the device is registered to the appropriate organization group in AirWatch.
When AirWatch is integrated with VMware Identity Manager and multiple AirWatch organization groups are configured, the Active Directory Global Catalog option cannot be configured for use with the VMware Identity Manager service.
