City Workspace ONE Access uses a hybrid LDAP bind from the cloud tenant through ExpressRoute to on-premises domain controllers. After a WAN flap, directory sync fails. An engineer wants to regenerate IdP metadata immediately. What should the administrator check first?
Select an answer to reveal the explanation.
Short Explanation
After a WAN burp, look at the road before reprinting the passport. Access still has the same IdP metadata; it just cannot reach the DCs. Prove ExpressRoute and LDAP reachability first — regenerating metadata is a later, rarer fix.
Full Explanation
When city Workspace ONE Access uses a hybrid LDAP bind from the cloud tenant through ExpressRoute to on-premises domain controllers and after a WAN flap directory sync fails while an engineer wants to regenerate IdP metadata immediately, verify the hybrid ExpressRoute or VPN path from Access or the Access connector to the on-premises domain controllers before rebuilding IdP metadata. Directory sync failures after WAN flaps are usually path problems; regenerating metadata first treats the symptom and can add needless IdP churn. Healing the civic directory path restores sync. Rebuilding NSX-T identity firewall groups, because IDFW metadata is shared with Access, fails by concept because IDFW groups do not share metadata with Access LDAP sync and rebuilding them does not heal ExpressRoute to DCs. Deploying Carbon Black Cloud sensors onto the domain controllers to restore LDAP fails by concept because CBC sensors do not restore LDAP bind over ExpressRoute. Switching Access to local accounts only and treat the flap as a Distributed Firewall event fails by concept because local-only Access abandons hybrid identity and misattributes a WAN path issue to DFW. Exam caveat: after WAN flap, verify Access/connector path to on-prem DCs before regenerating IdP metadata. Operational check: test connectivity from Access/connector to DCs over ExpressRoute/VPN, restore the path, confirm directory sync, avoid unnecessary metadata regen, and add WAN-path checks to the city Access incident runbook for municipal identity resilience.