Public-health Workspace ONE UEM cannot reach the on-premises CA or LDAP after a datacenter ACL change. The cloud UEM console itself is healthy. What should the administrator trace?
Select an answer to reveal the explanation.
Short Explanation
ACC is the on-prem mailman for UEM — the cloud console stays pretty while the mailman cannot reach LDAP or the CA. Trace outbound 443 from ACC to SaaS and the inside legs to AD and the certificate authority. Don't rebind NSX Manager's IDFW directory as if it were UEM.
Full Explanation
When public-health Workspace ONE UEM cannot reach the on-premises CA or LDAP after a datacenter ACL change while the cloud UEM console itself is healthy, trace AirWatch Cloud Connector outbound HTTPS to UEM SaaS and Connector-to-directory and CA paths on the internal side. Cloud console health does not prove ACC can reach internal CA/LDAP; ACL changes often break those civic connector paths. Restoring ACC northbound and southbound connectivity fixes enrollment and directory features. NSX-T Manager LDAP used for identity firewall, because UEM always shares that directory binding, fails by concept because UEM/ACC directory binding is separate from NSX Manager IDFW LDAP. Carbon Black Cloud sensor groups, because CA enrollment is performed by CB Defense, fails by concept because CBC sensor groups do not perform UEM CA enrollment via ACC. Distributed Firewall FQDN context on the UEM SaaS, because AirWatch Cloud Connector is not in the path, fails by concept because ACC is exactly in the on-premises integration path and DFW FQDN on SaaS does not replace ACC reachability. Exam caveat: healthy cloud UEM with broken on-prem CA/LDAP means ACC outbound to SaaS plus internal directory/CA paths—not NSX IDFW LDAP sharing or CBC. Operational check: verify ACC HTTPS to UEM SaaS and ACC to LDAP/CA after the ACL change, restore required ports, test directory sync and cert issuance, and record ACC dependencies in the public-health UEM network matrix for municipal EUC operations.