Library patrons must never single sign-on to the staff-only ILS administration app, even when the kiosk is enrolled in UEM. What should the administrator configure?
Select an answer to reveal the explanation.
Short Explanation
Enrollment is a library card for the kiosk, not a master key to staff tools. Access still has to check the Staff group before ILS admin SSO. A managed patron tablet can sit in Hub and still be denied that app.
Full Explanation
UEM enrollment manages the device; it does not authorize every application. Workspace ONE Access policies still evaluate group membership and other conditions before SSO. Restricting the ILS administration app to the Staff IdP group keeps patrons out even on enrolled kiosks. NSX-T allows and Carbon Black Cloud sensors do not replace that Access group check.