Building inspectors on Hub-enrolled, compliant phones may launch the city's GIS SaaS, but a personal laptop browser is challenged for MFA or denied. Which product enforces that launch decision?

Building inspectors on Hub-enrolled, compliant phones may launch the city’s GIS SaaS while a personal laptop browser is challenged for MFA or denied because Workspace ONE Access policies evaluate user and device context before the GIS application starts. Access is the conditional-access decision point for catalog launches: it can require Intelligent Hub enrollment, UEM compliance, network context, or step-up MFA depending on how the city wrote the policy. Think of Access as the bouncer at the GIS door—healthy inspector phones walk in; a random personal laptop gets a second look or a refusal. App Volumes fails by concept because it assigns application packages and writables to Horizon desktops; delivering a Windows layer to a VDI guest does not enforce SaaS launch decisions for phones versus unmanaged browsers. Dynamic Environment Manager fails because ADMX templates and user-environment settings act inside a Windows session to hide or configure local resources; DEM does not evaluate Hub enrollment against a GIS SaaS entitlement. Horizon Instant Clone customization fails because clone customization scripts rebuild or personalize VDI guests at pool provision or refresh time; they are not the SaaS conditional-access engine for mobile Hub clients. Exam caveat: Access policies depend on accurate device and compliance signals from Hub/UEM when those conditions are used; a mis-synced compliance state can incorrectly allow or deny GIS, and Access policy is not a substitute for GIS application-layer authorization inside the SaaS tenant itself. Operational check: launch GIS from a compliant Hub-enrolled inspector phone and confirm Access allows it, then attempt the same entitlement from an unmanaged personal laptop browser and confirm MFA step-up or denial matches the Access policy.