City AD users and groups must appear in Workspace ONE Access, and domain-joined clerk PCs should be able to use Kerberos to the catalog. Which on-premises component does that work?

When city AD users and groups must appear in Workspace ONE Access and domain-joined clerk PCs should be able to use Kerberos to the catalog, the on-premises component that does that work is Workspace ONE Access Connector, which syncs directory objects and supports on-premises authentication and virtual-app integration for Access. Access Connector is the on-campus runner that copies city AD into Access and can participate in LAN-side auth such as Kerberos. AirWatch Cloud Connector as “the only connector that can talk to Active Directory” fails by concept: ACC serves Workspace ONE UEM (enrollment services, directory integration for UEM, and related on-premises UEM needs), not Access identity sync and Access Kerberos integration. Unified Access Gateway copying the entire city AD forest into the DMZ fails because UAG is an edge proxy/appliance and must not be treated as a directory sync engine or a DMZ replica of AD. Workspace ONE Intelligence ETL importing AD groups as dashboard filters fails because Intelligence consumes analytics data for reports and widgets; it is not the Access directory connector. Exam caveat: Access Connector placement is internal near identity systems; confusing it with ACC or UAG is a common associate trap, and Kerberos silent sign-on additionally needs correct domain join, SPN/realm configuration, and Access auth method settings—not merely a running VM named “connector.” Operational check: verify Access Connector syncs city users and groups into Access, test Kerberos from a domain-joined clerk PC to the catalog, and confirm ACC and UAG are not the components performing Access directory sync.