Inspector iPads need device certificates from the city's on-premises CA while UEM itself is SaaS. How does that request typically reach the CA?
Select an answer to reveal the explanation.
Short Explanation
The civic CA lives in the basement; SaaS UEM lives on the street. Cloud Connector is the dumbwaiter that carries certificate requests down without dragging the CA onto the internet. Blast, App Volumes, and Boxer do not punch that ticket.
Full Explanation
Inspector iPads that need device certificates from the city’s on-premises CA while UEM itself is SaaS typically reach that CA through AirWatch Cloud Connector, which proxies certificate requests from SaaS UEM to the civic certificate authority. The CA stays internal; the connector is the controlled path so field devices can receive certificates without publishing the CA to the internet. Horizon Connection Server does not enroll iOS device certificates through Blast; Blast is a Horizon display protocol path. App Volumes Manager attaches Windows application layers at desktop login and does not issue iPad device certificates. Workspace ONE Boxer may use mail security features, but it is not the general mechanism that proxies device certificate enrollment from SaaS UEM to the civic CA. Exam caveat: certificate templates, ACC certificate channel configuration, and CA connectivity must all be healthy; Cloud Connector down often stalls new certificate issuance even when devices still check in. Operational check: request a device certificate for a lab inspector iPad via UEM, confirm Cloud Connector handles the CA exchange, verify the cert appears on the device, and ensure the CA has no inbound internet exposure.