Parks contractors must sign in through a separate identity provider and must not be able to reset city Active Directory passwords. How should the administrator design that identity provider?
Select an answer to reveal the explanation.
Short Explanation
A contractor IdP is a visitor badge printer, not a master key to city AD. Keep it isolated—no write-back, no domain-admin LDAP. Adding an IdP in Access does not mean that IdP may reset civic passwords.
Full Explanation
Workspace ONE Access can add a contractor identity provider without granting that IdP directory write-back into civic Active Directory. Isolation prevents contractors from resetting or unlocking staff passwords. Domain-admin LDAP rights and replacing civic AD invert the isolation requirement. Password sync write-back is the opposite of the parks security goal.