Public-health's disaster runbook assumes the statewide SAML identity provider may be unavailable. How should the administrator pre-stage Workspace ONE Access for that failure?
Select an answer to reveal the explanation.
Short Explanation
When the statewide ID desk is closed, clinics still need a locked spare key—not a propped-open door. Pre-stage an Access policy that can use a managed local IdP.
Full Explanation
When public-health's disaster runbook assumes the statewide SAML identity provider may be unavailable, the administrator should pre-stage a break-glass Access policy that accepts a managed local identity provider when the statewide SAML IdP is down. Treat break-glass Access as a locked clinic key cabinet usable only when the statewide badge system fails, still under Access policy control. Publishing an NSX-T Gateway Firewall any-any rule so clinics can skip identity during a disaster fails by concept because network any-any is not a governed identity fallback. Disabling Access entirely and handing clinic staff a shared local Windows password fails because shared passwords destroy accountability and are not Access break-glass. Moving clinic SSO to Carbon Black Cloud live-response as the identity fallback fails because live response is endpoint investigation, not an SSO identity provider path. Exam caveat: pre-stage a managed local or built-in IdP Access policy for SAML outages; firewall any-any, shared passwords, and CBC live response are not identity fallbacks. Operational check: create and test a break-glass Access policy with a managed local IdP, restrict who can use it, document activation steps in the public-health DR runbook, and verify clinic admin access when the statewide IdP is simulated down.