Library staff authenticate with Active Directory while volunteers use a separate local or social identity provider. How should Access be set up?

Library staff authenticate with Active Directory while volunteers use a separate local or social identity provider. Add both identity providers and use Access policies to choose which identity provider each application accepts—two front doors can share one building. Merging volunteer accounts into civic Active Directory so only one identity provider can exist fails by concept because Access supports multiple IdPs and forcing volunteers into civic AD expands directory scope unnecessarily. Configuring Carbon Black Cloud as a second identity provider for volunteer SSO fails because CBC is not an Access identity provider. Disabling Active Directory and forcing every staff member onto the volunteer social identity provider fails because staff must keep AD while volunteers use their separate IdP. Exam caveat: multi-population Access uses multiple IdPs plus policies selecting IdP per app—not force-merge into AD, not CBC as IdP, not disable AD for staff. Operational check: configure AD and volunteer IdPs, bind staff apps to AD and volunteer apps to the volunteer IdP via Access policies, test each population, and confirm staff AD remains enabled. Document which library applications accept which IdP so seasonal volunteer onboarding stays consistent.