An insurance firm allows staff to use personal phones on the corporate WLAN. Policy says each phone must end up with its own certificate-based identity rather than the employee's password, and phones that skip onboarding must stay on limited access. Which BYOD onboarding flow gives each phone its own certificate while keeping skipped phones limited?

The required flow first verifies an approved user and then issues a client certificate that identifies the individual phone. The certificate, rather than the employee’s password, can authenticate that phone to the corporate WLAN; devices that never complete onboarding remain in a restricted role. A user-scoped certificate reused across an employee’s phones is a familiar certificate-enrollment pattern, and it preserves restricted access for devices that skip enrollment. However, it identifies the employee, not each phone uniquely, so it misses the per-device identity requirement. Self-service enrollment can issue a unique certificate to each enrolled phone, but allowing devices that skip enrollment onto the normal WLAN violates the limited-access condition. MDM can also provision unique certificates, yet if the WLAN actually authenticates with a shared pre-shared key, the certificate is not the phone’s network identity; possessing a certificate alone does not satisfy certificate-based WLAN authentication. Exam caveat: distinguish the credential used to authorize enrollment from the credential used afterward for network access; both steps matter, and satisfying one does not establish the other. Practical check: inspect WLAN authentication and RADIUS logs to confirm that each enrolled phone presents a distinct certificate identity and that an unenrolled phone is assigned the restricted role.