Transit Workspace ONE Access policies that should restrict a cloud SaaS to the operations network now match any after the agency moved those operators onto a public-cloud desktop pool. The pool egresses through a new NAT prefix that was never added as an Access network range. What should the administrator update?

When transit Workspace ONE Access policies that should restrict a cloud SaaS to the operations network now match any after the agency moved those operators onto a public-cloud desktop pool egressing through a new NAT prefix never added as an Access network range, add the cloud NAT egress prefixes to Workspace ONE Access network ranges and attach those ranges to the access policy. Access network ranges key off client egress IPs; a new NAT prefix that is not listed causes policies to miss and appear to match any. Updating ranges restores civic network-restricted SaaS access. Writing an NSX-T Distributed Firewall rule on the on-premises overlay to match the cloud NAT, because Access cannot use IP ranges, fails by concept because Access does use network ranges and on-prem DFW does not fix Access policy matching for cloud desktop egress. Publishing a Carbon Black Cloud sensor group for the NAT prefix so CBC becomes the access policy engine fails by concept because CBC sensor groups are not Workspace ONE Access network-range policy. Enabling Guest Introspection on the cloud desktops so identity firewall replaces Access network ranges fails by concept because GI/IDFW do not replace Access network-range conditions for SaaS. Exam caveat: after moving users to cloud desktops with new NAT egress, update Access network ranges—do not pretend on-prem DFW, CBC, or GI replace that control. Operational check: add the NAT prefixes to Access network ranges, bind them to the SaaS policy, test from a cloud desktop, confirm non-operations egress is denied, and track NAT changes in the transit Access network-range register for municipal identity governance.