The BES must support Enterprise Identity's Zero Sign-On (ZSO) feature on Android for Work (AfW) devices.
This capability must allow a user, once they are authenticated to the AfW secure container, to access any and all applications to which they are entitle access by Enterprise Identity without further prompts for authentication.