If the civic mail relay blocks the Workspace ONE SaaS tenant, users never receive Intelligent Hub enrollment invites. Which dependency is failing?

If the civic mail relay blocks the Workspace ONE SaaS tenant, users never receive Intelligent Hub enrollment invites—SMTP email infrastructure is the failing dependency. In municipal EUC terms, treat the endpoint as a window into city systems when the architecture says so, not as the system of record for the files or apps in the stem. Distractor concept: DHCP in the VDI desktop VLAN is unrelated to Hub invite delivery. Distractor concept: Blast Extreme display protocol does not carry enrollment email. Distractor concept: Horizon Connection Server Windows edition is not the invite-mail path. Exam caveat: Enrollment/compliance email needs SMTP path to the SaaS tenant. Operational check: Test invite mail flow, allow-list the SaaS tenant on the civic relay, and confirm Hub invites arrive. Record the chosen control and the rejected failure modes in the civic change ticket or runbook so on-call staff and auditors share the same rationale after the next maintenance window. Re-validate after personnel or image changes that the same control still meets the city's continuity, security, and support expectations for this service. Helpdesk coaching tip aligned to the conversational brief: Hub invites ride the city's mail truck. If SMTP to the SaaS tenant is blocked, the invites never land — that is a Workspace ONE email-infrastructure dependency, not DHCP, Blast, or Connection Server.