Client-anonymous mode is acceptable for:

  • Single administrator systems
  • Simple deployments that only protect ESAM artifacts
  • Environments that do not need ESAM identities or role-based authorization

If customers need auditability, multiple administrators, or stronger governance, direct them to convert the installation to managed mode.