After a perimeter firewall change, city permitting portal administrators can no longer open the Workspace ONE UEM console from the civic jump network. Which change re-enables the console without weakening the edge?
Select an answer to reveal the explanation.
Short Explanation
The UEM console is a locked city-hall door, not the whole civic boulevard. Open only the documented console and API destinations from the jump network, and leave the rest of the LAN closed.
Full Explanation
After a perimeter firewall change, city permitting-portal administrators regain Workspace ONE UEM console access by allowing only the documented UEM console and API FQDNs and ports from the civic jump network. That restores the locked city-hall management door without opening the whole civic LAN as an outbound boulevard to the SaaS tenant. Permit-any outbound from the entire civic LAN fails by concept because it expands the management-plane blast radius to every workstation, printer, and kiosk that should never talk to the admin console. Publishing the UEM admin URL on guest Wi-Fi fails because lobby and citizen SSIDs are untrusted sources and must not administer devices. Replacing the UEM path with an NSX-T T0 default route so all SaaS is treated as trusted fails because overlay default routing is not an application allow list and conflates connectivity with explicit component enablement. Exam caveat: Workspace ONE console enablement means documented destinations and ports from trusted jump sources—not any-any LAN egress, not guest publication, and not equating NSX routing with UEM console policy. Operational check: from a jump host, resolve and reach the console and API FQDNs over required ports, confirm administrators open the UEM UI, verify guest and general LAN sources remain denied, and send allow-rule hits to the civic SIEM. Record the exact FQDN and port set in the change ticket so the next perimeter edit does not recreate an outage for permitting staff.