SEP Mobile is properly updating labels in Airwatch when installing and removing malicious apps
It's not working if labels are removed from Airwatch manually
Device tag uploading to MDM is triggered by the events uploaded by the device, MC uploads the tag during handling the device event so MDM tags are updated promptly.
Device tag downloading from MDM is a part of MDM sync, based on the tag sync frequency configured in MDM configuration. That means not every MDM sync will do tag sync.
The current tag sync frequency is configured as 24h in the MDM configuration.
Labels get updated every 24 hours as configured.