A design agency wants 120 employees to use personal laptops on the corporate WLAN. Staff must enroll and remove their own devices without IT visiting each desk, access must be EAP-TLS with a per-user certificate from the company's own CA, and every registered device must remain listed while registered. Which BYOD components in ISE meet these enrollment requirements?

The BYOD and My Devices portals support employee self-service for enrolling devices and removing them later, while a provisioning profile guides the device through onboarding. Integrating the company’s enterprise CA with ISE lets the workflow issue the required per-user certificates for EAP-TLS; the My Devices portal also lets users see their registered devices. Using ISE’s internal CA is a viable certificate-based onboarding design, but it fails the explicit requirement to use the company’s own CA. Allowing self-enrollment while reserving device removal for IT may be a workable administrative process, but employees could not complete both enrollment and removal themselves. Issuing a certificate per laptop is also a common EAP-TLS design, yet it does not meet the requirement for a per-user certificate; device identity and certificate subject or identity mapping are not interchangeable. Exam caveat: distinguish the CA that issues certificates from the portal and provisioning components that enable onboarding, and check whether the question specifies per-user versus per-device identity. Practical check: test enrollment, certificate issuance, EAP-TLS authentication, portal visibility, and user-initiated removal on a pilot device, then verify the certificate issuer and the registered-device record in ISE.