City employees see applications in Intelligent Hub that they cannot open. What should the administrator treat as two separate controls?
Select an answer to reveal the explanation.
Short Explanation
Seeing a tile in Hub is like seeing a door on the directory board; it does not mean the lock will open. Assignment puts the icon there, Access policy decides SSO. Fix whichever of those two is wrong instead of assuming visibility equals access.
Full Explanation
City employees see applications in Intelligent Hub that they cannot open. Treat entitlement assignment in the catalog as separate from the Access policy—both must succeed to open the application. Seeing a tile is like seeing a door on the directory board; it does not mean the lock will open. Treating Hub catalog assignment as the same as satisfying the Access authentication policy fails by concept because visibility and authentication authorization are distinct controls. Assuming that if the tile is visible, NSX-T has already authorized the SaaS session fails because NSX does not grant Workspace ONE Access SSO. Assuming Carbon Black Cloud reputation of the application tile grants SSO fails because CBC reputation is unrelated to Access entitlement. Exam caveat: Hub assignment ≠ Access policy success; troubleshoot both planes when users see tiles they cannot open. Operational check: for a failing app, verify the user or device is assigned the Hub entitlement, then verify Access policy allows the user, device posture, and network conditions; fix the failing plane without assuming visibility equals access. Train civic service desk to ask whether the failure is missing tile versus tile-present-SSO-deny to route tickets correctly.