HR disables a departing inspector in the directory that Access consumes. The inspector's city phone is still enrolled in UEM until the next inventory job. What should happen immediately?
Select an answer to reveal the explanation.
Short Explanation
Killing the badge stops the doors even if the city phone is still in the drawer with a sticker on it. Access owns app launch; UEM owns the device record and may catch up later. A leftover enrollment is not a leftover identity.
Full Explanation
When HR disables a departing inspector in the directory that Access consumes while the inspector’s city phone remains enrolled in UEM until the next inventory job, SaaS launches through Access should stop immediately because identity no longer authorizes the catalog, even though the device record may linger in UEM. Killing the badge stops the doors even if the city phone is still in the drawer with an enrollment sticker on it. Access owns app launch authorization from identity; UEM owns the device lifecycle and may catch up later with retirement, enterprise wipe, or profile removal. The claim that UEM automatically factory-resets the phone the moment Access loses the user object fails by concept: UEM actions are driven by UEM policies, admin actions, and compliance workflows—not an instantaneous hard-wired factory reset solely because Access lost the directory object. Horizon Client keeping every SaaS bookmark because Blast sessions outlive Access accounts fails because Blast sessions are Horizon display-protocol sessions, not a substitute for Access SSO to SaaS, and bookmarks in a client do not recreate Access entitlements. Workspace ONE Intelligence re-creating the Access user from the last compliance widget fails because Intelligence reports and automates on telemetry—it does not mint or restore Access identities from a dashboard. Exam caveat: device wipe, selective wipe, or unenrollment timing depends on UEM policy and connectivity; associate-depth questions separate identity deprovisioning (Access) from device record cleanup (UEM), and both may be required in a full offboarding runbook. Operational check: disable the inspector in the directory Access consumes, attempt a SaaS launch through Hub/Access and confirm denial, then inspect UEM and confirm the device object can still exist until an inventory or offboarding workflow retires it.