A bank lets staff use personal laptops and tablets on the corporate WLAN. Each user must run a self-service enrollment once at onboarding that installs a client certificate, and every enrolled device must land in a role that reaches business services rather than the whole corporate network. Which ISE BYOD onboarding design satisfies the enrollment, certificate, and access requirements?

The correct design uses the BYOD flow to meet all three requirements together: the user self-registers once at onboarding, client provisioning installs a certificate for device authentication, and the resulting authorization role limits reach to business services. Having IT provision certificates and associate devices in advance can support EAP-TLS and least-privilege access, but it substitutes administrator-led preparation for the required user self-service enrollment at onboarding. Using portal registration and certificate provisioning but assigning the standard employee role may successfully enroll and authenticate the device; however, broad corporate access violates the requirement that enrolled devices be confined to business services. Self-registration with PEAP and a restricted role can provide a familiar credential-based WLAN login and appropriate authorization, but it does not install the required client certificate, so it misses the certificate-enrollment requirement. Exam caveat: portal registration alone does not prove that a client certificate was issued and installed; distinguish registration from certificate provisioning and authentication. Practical check: test a newly enrolled personal device end to end, confirm the certificate is present and used for authentication, verify repeat access does not require re-enrollment, and inspect the assigned role’s reachable services.