The public-health third-party identity provider is down, and clinic administrators still need a governed sign-in path from the civic jump network. What should the administrator have ready?
Select an answer to reveal the explanation.
Short Explanation
When the state IdP is dark, you still use a labeled spare key from the jump room—not a hallway pass for every clinic. Pre-build that Access policy on the built-in IdP.
Full Explanation
When the public-health third-party identity provider is down and clinic administrators still need a governed sign-in path from the civic jump network, the administrator should have ready a break-glass Workspace ONE Access policy that uses a built-in identity provider and is limited to the jump network. Treat break-glass as a sealed clinic key that only works from the jump room when the statewide IdP is dark. An NSX-T Distributed Firewall any-any from clinics to every SaaS tenant fails by concept because network any-any is not a governed SSO fallback and widens exposure. A shared break-glass Windows local account emailed to all clinic staff fails because shared passwords destroy accountability and are not Access policy. Carbon Black Cloud bypass so Hub is not required during the outage fails because bypassing endpoint prevention does not restore governed SSO. Exam caveat: operational federation includes a managed Access break-glass policy with a built-in IdP scoped to the jump network. Operational check: pre-stage and periodically test the jump-network break-glass Access policy, restrict eligible admins, activate only during IdP outage, and document activation and deactivation in the public-health identity DR runbook.