When we installed Workspace ONE years ago, the advice was to have the DS servers and the SEG servers installed in a workgroup, but it was okay to have the Console and ENS servers joined into the domain. Is this still current best practice? Can DS and SEG be in the domain now? What are the ramifications of doing that? If not in the same domain, could these machines perhaps be in a separate domain/forest (for better administrative oversight)? If anyone has references to installation documents that discuss this, please post them here. I checked and did not find that particular part of the installation process in the latest installation docs.