1V0-61.21 · Question #48
Workspace ONE "Mobile* SSO" requires which of the following components?
The correct answer is D. Workspace ONE Access. Workspace ONE Access is the identity provider (IdP) component that powers Mobile SSO. It handles the certificate-based authentication flow that allows users to silently sign in to apps on managed devices without entering credentials - it's the core IAM infrastructure that SSO…
Question
Workspace ONE "Mobile* SSO" requires which of the following components?
Options
- AWorkspace ONE Boxer
- BWorkspace ONE Intelligence
- CWorkspace ONE Assist
- DWorkspace ONE Access
How the community answered
(20 responses)- A5% (1)
- B5% (1)
- D90% (18)
Explanation
Workspace ONE Access is the identity provider (IdP) component that powers Mobile SSO. It handles the certificate-based authentication flow that allows users to silently sign in to apps on managed devices without entering credentials - it's the core IAM infrastructure that SSO depends on.
Why the distractors are wrong:
- A. Boxer - A secure enterprise email/calendar app; it can benefit from SSO but isn't required to run it.
- B. Intelligence - An analytics and automation platform for insights and workflows; has no role in authentication brokering.
- C. Assist - A remote support/screen-share tool for IT helpdesk use; unrelated to identity or SSO.
Memory tip: Think of the word "Access" literally - you need Access to access things via SSO. Every other option is a productivity or support app layered on top; only Access is the identity backbone that makes "sign in once, use everything" possible.
Topics
Community Discussion
8
Prof. SaraJun 19, 2026The correct answer is D, Workspace ONE Access. Mobile SSO depends on Workspace ONE Access because it is the identity provider component that handles certificate-based authentication, federates with your directory, and issues the tokens that allow users to silently authenticate into apps without re-entering credentials. Think of it this way: "Access" is literally in the name of the feature's job, and without an IdP brokering that trust chain, there is no single sign-on to broker.
Anjali D.Jun 27, 2026Saw this exact question, almost picked B, but Access is what handles SSO identity.
Prof. SaraJun 27, 2026Access handles identity federation, but the deeper reason SSO works there is that Access sits in front of the origin and evaluates JWT-based identity before the request ever reaches your app, which is worth knowing when the blueprint asks about Zero Trust architecture.
Viktor S.Jun 27, 2026Mobile SSO is literally just Workspace ONE Access doing the SAML/OAuth brokering through the app tunnel, so D is the only one that makes sense here. Boxer (A) is a mail app, not an authentication broker, and I can see people picking it because it shows up in the same mobile productivity slide decks, but knowing that trap is why you study the architecture instead of the slide titles.
Luis F.Jun 28, 2026Solid breakdown, though worth noting that Tunnel (not just Access) is doing the heavy lifting on the transport side, and a lot of people trip up on that distinction when the question specifically calls out per-app VPN behavior.
Ivana K.Jun 27, 2026Mobile SSO in Workspace ONE is an identity broker flow, so it absolutely requires Workspace ONE Access as the token authority and identity provider that handles the SAML or OAuth assertions behind the scenes. Without Access, there is no SSO policy engine to issue the tokens that native apps rely on for passwordless authentication.
Luis F.Jun 27, 2026Guys I keep coming back to C, Workspace ONE Assist, because Mobile SSO has to have some kind of remote support layer to handle the authentication handoff between devices and the identity provider, and Assist is literally the component that bridges that gap in real deployments I have seen in my labs. Has anyone else tested this in a sandbox environment because I feel like the remote session capability in Assist is what ties the whole Mobile SSO flow together?
Prof. SaraJun 28, 2026Luis, Workspace ONE Assist is purely a remote support tool for helpdesk-driven device sessions and plays no role in the Mobile SSO authentication chain, so the correct pick is D, Workspace ONE Access, which is the actual identity provider that issues the SSO token and brokers the trust relationship between the managed device and your target application.