Public-works crews need the internal work-order app on a phone to reach the civic LAN without putting the whole device on VPN. Which Workspace ONE productivity app provides that per-app path through Unified Access Gateway?
Select an answer to reveal the explanation.
Short Explanation
Tunnel is a straw for one work app, not a firehose for the whole phone. Horizon Client paints desktops, Boxer is mail, and Assist is remote control. For a managed app that must reach the civic LAN through UAG, pick Workspace ONE Tunnel.
Full Explanation
Workspace ONE Tunnel is the productivity component that provides per-app micro-VPN for managed applications, typically through Unified Access Gateway, so a public-works work-order app can reach the civic LAN without placing the entire phone on VPN. That scoped path is the associate answer whenever only nominated apps need internal reachability. Crew phones can keep personal apps on the cellular path while only the managed work-order client receives the Tunnel route into the maintenance network. VMware Horizon Client carries Blast Extreme or PCoIP for desktops and published apps; it is not a general micro-VPN that proxies every mobile application's TCP traffic. Workspace ONE Boxer is the managed mail client and does not proxy arbitrary application sockets for a work-order backend. Workspace ONE Assist is remote control and support tooling; it does not become a VPN path to the civic LAN. Exam caveat: Tunnel is application-scoped; designs that require full-device always-on IPsec sit outside Tunnel's exam purpose even though both approaches move traffic toward internal networks. Operational check: Assign Tunnel only to the work-order app, confirm it reaches the internal API through UAG, and verify that unmanaged browsers on the same device cannot use that path.