The county must entitle the same Hub catalog to employees in county Active Directory and to a separate contractor OU. Where are those identity sources consumed for SSO and groups?

When the county must entitle the same Hub catalog to employees in county Active Directory and to a separate contractor OU, those identity sources are consumed for SSO and groups in Workspace ONE Access, which brings directories in through Access Connector for users and groups. Access is the receptionist who can read more than one staff roster—county AD and a contractor OU—then hand out the same catalog based on group entitlements. Horizon Connection Server LDAP fails by concept: Connection Server can use Active Directory for desktop and application pool entitlements, but that LDAP use is not the Hub/Access catalog identity store for SaaS, web, and mixed digital-workspace launches. Workspace ONE Intelligence data warehouse fails because reports and analytics consume data they are given; Intelligence is not where directories are bound as identity sources for SSO. Unified Access Gateway storing a local copy of every AD user in the DMZ fails because UAG is an edge appliance and should not be treated as the authoritative identity directory or a DMZ clone of AD for Access groups. Exam caveat: multiple directories and contractor OUs require correct Access directory configuration, Connector connectivity, and group mapping; Horizon pool entitlements and Access catalog entitlements can both use AD groups yet remain separate control planes. Operational check: confirm both county employee and contractor directory sources sync into Access via Access Connector, entitle a shared Hub catalog application to groups from each source, and verify UAG and Intelligence are not where those directories were bound.