Both Access Connector and AirWatch Cloud Connector often make outbound connections so city Active Directory stays off the internet. How should a technician tell them apart?

Both Access Connector and AirWatch Cloud Connector often make outbound connections so city Active Directory stays off the internet, and a technician should tell them apart by role: Access Connector serves Workspace ONE Access for identity sync and on-premises authentication, while AirWatch Cloud Connector serves Workspace ONE UEM. The pattern looks like two city vans that both leave the garage outbound—the Access van stocks the identity catalog; the Cloud Connector van stocks UEM. They are not the same installer whose name changes only after an Omnissa rebrand; treating rebrand trivia as architecture fails the exam concept. The claim that Access Connector only manages iOS devices while Cloud Connector only manages Horizon agents fails because neither statement matches product scope—Access Connector is about Access identity, and ACC is about UEM services, not a Horizon Agent management exclusive. Calling Cloud Connector the DMZ reverse proxy and Access Connector the Blast Extreme edge fails because those edge/proxy roles belong to Unified Access Gateway (and Horizon infrastructure), not to the directory connectors. Exam caveat: both connectors commonly use outbound-to-cloud connectivity for hybrid designs, so network diagrams can look similar; product affiliation (Access vs UEM) is the distinguishing associate fact, and neither connector replaces UAG. Operational check: map which connector VM talks to Access versus which talks to UEM, confirm directory sync for the Hub catalog depends on Access Connector, and confirm device/UEM on-premises services depend on Cloud Connector rather than a single renamed binary.