A transit Workspace ONE Access connector stays disconnected from the Access tenant after the city proxy began SSL inspection. Outbound TCP 443 from the connector VM is permitted. What should the administrator check next?

When a transit Workspace ONE Access connector stays disconnected from the Access tenant after the city proxy began SSL inspection while outbound TCP 443 from the connector VM is permitted, bypass SSL inspection for Access SaaS destinations, or install the proxy CA, so the connector's TLS trust to the tenant is not broken. Port 443 open is not enough if SSL inspection breaks certificate trust to Access SaaS. Fixing TLS trust restores civic connector sync. Rewriting NSX-T gateway firewall any-any on the connector segment so identity firewall can replace the connector fails by concept because gateway any-any and IDFW cannot replace the Access connector's TLS session to the tenant. Installing a CB Defense sensor on the connector and relying on Carbon Black Cloud to broker Access sync fails by concept because CBC does not broker Workspace ONE Access connector synchronization. Converting the connector to an NSX-T Guest Introspection partner so Manager proxies SaaS TLS fails by concept because Guest Introspection partners do not proxy Access connector SaaS TLS. Exam caveat: connector disconnect after SSL inspection with 443 permitted means TLS trust/bypass or proxy CA—not NSX any-any, CBC brokerage, or GI conversion. Operational check: exempt Access SaaS from SSL inspection or deploy the proxy CA to the connector trust store, confirm connector Connected, verify directory sync, and record the proxy exception in the transit Access architecture for municipal identity operations.